Finance.js vulnerable to DoS via the IRR function’s depth parameter

Description

Finance.js v4.1.0 contains a Denial of Service (DoS) vulnerability via the IRR function’s depth parameter. Improper handling of the recursion/iteration limit can lead to excessive CPU usage, causing application stalls or crashes.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 4.1.0

References

• GHSA-f8r4-mf27-rf7m
• medium.com
• raw.githack.com
• financejs.com
• CVE-2025-56571
• CWE-400
• CWE-770
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Finance.js vulnerable to DoS via the seekZero() parameter - CVE-2025-56572
• Mermaid improperly sanitizes sequence diagram labels leading to XSS - CVE-2025-54881
• Payload does not invalidate JWTs after log out (GHSA-5v66-m237-hwf7) - CVE-2025-4643
• Vite's server.fs.deny bypassed with /. for files under project root - CVE-2025-46565

Tags:

npm

financejs