Finance.js vulnerable to DoS via the seekZero() parameter

Description

An issue in finance.js v.4.1.0 allows a remote attacker to cause a denial of service via the seekZero() parameter.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 4.1.0

References

• GHSA-5q7q-p8pc-782h
• medium.com
• raw.githack.com
• financejs.com
• CVE-2025-56572
• CWE-400
• CWE-770
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Finance.js vulnerable to DoS via the IRR function’s depth parameter - CVE-2025-56571
• Flowise Vulnerable to SQL Injection via `tableName` Parameter - CVE-2025-29189
• MCP Inspector is Vulnerable to Potential Command Execution via XSS When Connecting to an Untrusted MCP Server - CVE-2025-58444
• Vega vulnerable to Cross-site Scripting via RegExp.prototype[@@replace] - vega - CVE-2025-27793

You might also like:

CSRF, XXE, and 12 Other Security Acronyms Explained

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

financejs