CVE-2025-62517
Medium
Description
Rollbar.js offers error tracking and logging from Javascript to Rollbar. In versions before 2.26.5 and from 3.0.0-alpha1 to before 3.0.0-beta5, there is a prototype pollution vulnerability in merge(). If application code calls rollbar.configure() with untrusted input, prototype pollution is possible. This issue has been fixed in versions 2.26.5 and 3.0.0-beta5. A workaround involves ensuring that values passed to rollbar.configure() do not contain untrusted input.
SeverityMedium
CVSS5.9
Exploit probability—
Product
Rollbar
PublishedOct 23, 2025
First seenOct 23, 2025
Weakness typeCWE-1321Prototype pollution
How to fix
Update
- rollbar2.26.5, 3.0.0-beta5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| rollbarnpm | v < 2.26.5, 3.0.0-alpha1 ≤ v < 3.0.0-beta5 | 2.26.5, 3.0.0-beta5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.