medium5.9
CVE-2025-62517
rollbar vulnerable to Prototype Pollution in merge()
Impact
### Impact Prototype pollution vulnerability in merge(). If application code calls `rollbar.configure()` with untrusted input, prototype pollution is possible. ### Patches Fixed in 2.26.5 and 3.0.0-beta5. ### Workarounds Ensure that values passed to `rollbar.configure()` do not contain untrusted input. ### References Fixed in https://github.com/rollbar/rollbar.js/pull/1394 (2.26.x) and https://github.com/rollbar/rollbar.js/pull/1390 (3.x)
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | rollbar | <= 2.26.4 | 2.26.5 |
Affected products
| Product | Affected versions |
|---|---|
| Versions | before 2.26.5 |
| From 3.0.0-Alpha1 To | before 3.0.0-beta5 |
Versions were read from the advisory text. No structured product data has been published for this record yet.
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/rollbar/rollbar.js/commit/61032fe6c208b71e249514800808a54bcb8cb8bb
- https://github.com/rollbar/rollbar.js/commit/d717def8b68f4a947975d0aebb729869cdb2d343
- https://github.com/rollbar/rollbar.js/pull/1390
- https://github.com/rollbar/rollbar.js/pull/1394
- https://github.com/rollbar/rollbar.js/security/advisories/GHSA-xcg2-9pp4-j82x
- https://github.com/advisories/GHSA-xcg2-9pp4-j82x
- https://nvd.nist.gov/vuln/detail/CVE-2025-62517