GitHub Advisoryadvisory · npm

GHSA-f8r4-mf27-rf7m Finance.js vulnerable to DoS via the IRR function’s depth parameter

HIGH Published 2025-09-30 Modified 2025-10-06 Official page ↗
Aliases
CVE-2025-56571
Ecosystem
npm
Packages
financejs
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400, CWE-770, CWE-834
Reviewed
2025-09-30

Affected packages

• npm financejs: <= 4.1.0 (no fix yet)

Description

Finance.js v4.1.0 contains a Denial of Service (DoS) vulnerability via the IRR function’s depth parameter. Improper handling of the recursion/iteration limit can lead to excessive CPU usage, causing application stalls or crashes.

Related

Alias · CVE (1)

  • CVE-2025-56571 Finance.js v4.1.0 contains a Denial of Service (DoS) vulnerability via the IRR function’s depth parameter. vulnerability

Weakness · CWE (3)

  • CWE-400 Uncontrolled Resource Consumption weakness
  • CWE-770 Allocation of Resources Without Limits or Throttling weakness
  • CWE-834 Excessive Iteration weakness

References