Executive brief
bigint-money is a Node.js library used to handle monetary values with precision in financial applications. Versions prior to 0.6.2 contain a rounding error that can produce incorrect monetary calculations, potentially causing financial discrepancies in applications that depend on this library.
Technical details
The vulnerability is an incorrect calculation (CWE-682) in the bigint-money library where certain numbers are rounded improperly. The library is used in financial systems where precision is critical; the rounding errors could lead to incorrect money calculations. This is a logic flaw in the calculation engine rather than a security boundary bypass. The fix is available in version 0.6.2 and later. No active exploitation in the wild has been reported.
Affected products
- npm bigint-money prior to 0.6.2
Timeline
- 2020-09-11: disclosed
- 2020-09-11: patched: Fixed in version 0.6.2