GHSA-xcg2-9pp4-j82xMediumCVSS 5.9

rollbar vulnerable to Prototype Pollution in merge()

Published
October 23, 2025
Last Modified
October 24, 2025

🔗 CVE IDs covered (1)

CVE-2025-62517 →

📋 Description

Impact

Prototype pollution vulnerability in merge(). If application code calls rollbar.configure() with untrusted input, prototype pollution is possible.

Patches

Fixed in 2.26.5 and 3.0.0-beta5.

Workarounds

Ensure that values passed to rollbar.configure() do not contain untrusted input.

References

Fixed in https://github.com/rollbar/rollbar.js/pull/1394 (2.26.x) and https://github.com/rollbar/rollbar.js/pull/1390 (3.x)

🎯 Affected products2

  • npm/rollbar:<= 2.26.4
  • npm/rollbar:>= 3.0.0-alpha1, <= 3.0.0-beta4

🔗 References (7)