7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-56572

CVE-2025-56572: Finance.js vulnerable to DoS via the seekZero() parameter

An issue in finance.js v.4.1.0 allows a remote attacker to cause a denial of service via the seekZero() parameter.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-56572

CVE-2025-56572:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
financejs	npm	<= 4.1.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability CVE-2025-56572 lies in the seekZero function in finance.js. This function is designed to find the root of a given function fn. However, it lacks any mechanism to limit the number of iterations of its while loops. An attacker can exploit this by causing the fn function to behave in a way that the loops never terminate.

The seekZero function is not directly exposed as part of the public API of the finance.js library. Instead, it is used internally by the IRR (Internal Rate of Return) function. The IRR function is part of the public API and can be called with user-controlled input (an array of cash flows).

The IRR function creates a helper function, npv, and passes it as the fn argument to seekZero. The return value of this npv function depends on the cash flows provided by the user. By providing a malicious set of cash flows, an attacker can control the return values of the npv function, and in turn, control the execution of the while loops inside seekZero.

Specifically, an attacker can ensure that the condition to exit the while loops in seekZero is never met, causing an infinite loop. This will lock up the Node.js event loop or the browser's main thread, leading to a Denial of Service.

Therefore, during an exploit, a runtime profiler would show a call to Finance.IRR, which in turn calls seekZero, where the application's execution will be stuck. Both functions are critical for identifying the vulnerability at runtime.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.