Python's JSON Parser Accepts NaN, Creating Silent Balance Corruption Bug

A developer tutorial on DEV Community highlights a subtle but serious vulnerability in Python Flask-based web servers that handle numeric JSON input. Python's native json module silently accepts non-standard JSON constants like NaN, converting them to float('nan') and allowing them to pass standard numeric type checks. Once NaN enters the application state, all subsequent arithmetic operations also return NaN, effectively bypassing balance validation and enabling unlimited withdrawals. The problem compounds when persisting data: SQLite converts NaN to NULL while PostgreSQL stores it as an actual numeric value, corrupting the database in different ways. The article demonstrates why developers must explicitly validate parsed numbers for finiteness, not just type, when processing financial or sensitive numeric inputs.