rollbar vulnerable to Prototype Pollution in merge()

MEDIUM 5.9CVE-2025-62517 · GHSA-xcg2-9pp4-j82x · Published 23/10/2025 · updated 08/10/2026

In short

CVE-2025-62517 is a MEDIUM (CVSS 5.9) vulnerability affecting rollbar.
Chance of exploitation in the next 30 days (EPSS): 0.39%, higher than 33.7% of all vulnerabilities.
Fix: update to 3.0.0-beta5, 2.26.5 or later.

Package	Affected versions	Patched versions
rollbar npm	`≥ 3.0.0-alpha1, < 3.0.0-beta5< 2.26.5`	`3.0.0-beta52.26.5`

Description

Impact

Prototype pollution vulnerability in merge(). If application code calls rollbar.configure() with untrusted input, prototype pollution is possible.

Patches

Fixed in 2.26.5 and 3.0.0-beta5.

Workarounds

Ensure that values passed to rollbar.configure() do not contain untrusted input.

References

Fixed in https://github.com/rollbar/rollbar.js/pull/1394 (2.26.x) and https://github.com/rollbar/rollbar.js/pull/1390 (3.x)

NVD description

Rollbar.js offers error tracking and logging from Javascript to Rollbar. In versions before 2.26.5 and from 3.0.0-alpha1 to before 3.0.0-beta5, there is a prototype pollution vulnerability in merge(). If application code calls rollbar.configure() with untrusted input, prototype pollution is possible. This issue has been fixed in versions 2.26.5 and 3.0.0-beta5. A workaround involves ensuring that values passed to rollbar.configure() do not contain untrusted input.

References

rollbar/rollbar.js security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2025-62517 · ADVISORY
rollbar/rollbar.js#1390 · WEB
rollbar/rollbar.js#1394 · WEB
rollbar/rollbar.js commit 61032fe · WEB
rollbar/rollbar.js commit d717def · WEB
rollbar/rollbar.js · PACKAGE

More vulnerabilities in rollbar

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

rollbar

npm

≥ 3.0.0-alpha1, < 3.0.0-beta5< 2.26.5

3.0.0-beta52.26.5

Description

Impact

Prototype pollution vulnerability in merge(). If application code calls rollbar.configure() with untrusted input, prototype pollution is possible.

Patches

Fixed in 2.26.5 and 3.0.0-beta5.

Workarounds

Ensure that values passed to rollbar.configure() do not contain untrusted input.

References

Fixed in https://github.com/rollbar/rollbar.js/pull/1394 (2.26.x) and https://github.com/rollbar/rollbar.js/pull/1390 (3.x)

NVD description