Finance.js Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in Finance.js version 4.1.0. The issue arises in the seekZero() function, which lacks proper iteration limits, potentially leading to infinite loops. This flaw can cause excessive CPU usage and application crashes in both browser and Node.js environments.

Impact

Exploitation of this vulnerability can lead to increased CPU consumption, causing the application to stall or crash.

Reproduction

The vulnerability can be reproduced by calling the seekZero() function with a parameter that creates an infinite loop, such as a function that always returns a positive value. This will cause the function to continuously iterate without stopping, eventually overwhelming the CPU and causing the application to crash.