Listen to this Post
The CVE-2025-XXXXX vulnerability in Finance.js v4.1.0 resides in the Internal Rate of Return (IRR) function. This financial function calculates the discount rate that makes the net present value of cash flows zero. The function accepts a `depth` parameter that controls the recursion level or number of iterations for its numerical approximation algorithm. An attacker can exploit this by providing an excessively large value for the `depth` parameter. The function’s logic lacks proper input validation and fails to enforce a reasonable upper bound on this parameter. Consequently, when processing a maliciously high depth value, the function enters a prolonged state of computation, engaging in a massive number of recursive calls or iterative calculations. This process consumes 100% of the CPU core it is running on for an extended duration, leading to a complete denial of service as the event loop is blocked and the application becomes unresponsive to any other requests.
Platform: Node.js
Version: 4.1.0
Vulnerability: DoS
Severity: High
date: 2025-09-30
Prediction: Patch by 2025-10-07
What Undercode Say:
npm list finance.js
const finance = require('finance.js');
// Malicious payload triggering DoS
finance.IRR([-100, 39, 59, 55, 20], 1000000000);
How Exploit:
Craft HTTP request with large depth value.
Targets IRR API endpoint.
Causes event loop blockage.
Protection from this CVE
Upgrade Finance.js package.
Implement input validation WAF.
Set lower recursion limits.
Impact:
Application unresponsive.
High CPU consumption.
Service disruption.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
