CVE-2025-56571

HighCVSS 7.5

Published: 30/09/2025(UTC)Updated: 05/07/2026(UTC)Translated: 06/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.40%

32th percentile - higher than 32% of all known CVEs

Summary

Finance.js version 4.1.0 contains a Denial of Service (DoS) vulnerability via the depth parameter in the IRR function. Improper handling of the recursion/iteration limit can lead to excessive CPU usage, causing application stalls or crashes.

Risk Assessment

An attacker can remotely overload the server, causing the financial application to become unavailable to users, resulting in service disruption and potential financial losses.

Recommendation

It is recommended to immediately update the Finance.js library to the latest version that fixes this vulnerability, or apply application-level restrictions on the depth parameter in the IRR function.

Other vulnerabilities in Finance.js

CVE-2025-56572High
An issue in finance.js v.4.1.0 allows a remote attacker to cause a denial of service via the seekZero() parameter.

Original NVD description (English source)

Finance.js v4.1.0 contains a Denial of Service (DoS) vulnerability via the IRR function’s depth parameter. Improper handling of the recursion/iteration limit can lead to excessive CPU usage, causing application stalls or crashes.