GitHub Advisoryadvisory · npm

GHSA-xcg2-9pp4-j82x rollbar vulnerable to Prototype Pollution in merge()

MEDIUM Published 2025-10-23 Modified 2025-10-24 Official page ↗
Aliases
CVE-2025-62517
Ecosystem
npm
Packages
rollbar
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-1321
Reviewed
2025-10-23

Affected packages

• npm rollbar: < 2.26.5 → fixed in 2.26.5 • npm rollbar: >= 3.0.0-alpha1, < 3.0.0-beta5 → fixed in 3.0.0-beta5

Description

Impact Prototype pollution vulnerability in merge(). If application code calls `rollbar.configure()` with untrusted input, prototype pollution is possible. Patches Fixed in 2.26.5 and 3.0.0-beta5. Workarounds Ensure that values passed to `rollbar.configure()` do not contain untrusted input. References Fixed in https://github.com/rollbar/rollbar.js/pull/1394 (2.26.x) and https://github.com/rollbar/rollbar.js/pull/1390 (3.x)

Related

Alias · CVE (1)

  • CVE-2025-62517 Rollbar.js offers error tracking and logging from Javascript to Rollbar. vulnerability

Weakness · CWE (1)

  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness

References