Finance.js Denial-of-Service Vulnerability via IRR Function Depth Parameter

A denial-of-service vulnerability has been identified in Finance.js version 4.1.0. The issue arises in the IRR function, where the depth parameter is not properly managed. This lack of control over recursion and iteration limits can lead to excessive CPU usage, causing the application to stall or crash.

Impact

Exploitation of this vulnerability leads to excessive CPU consumption, causing application stalls or crashes.

Reproduction

To reproduce this vulnerability, use the IRR function in Finance.js v4.1.0 with a depth parameter that exceeds the function's recursion limit. This can be done by providing a cash flow array that triggers deep recursion, such as one with many cash flow periods that the function must iterate through.