CVE-2025-62517 - CVE House
Back to Database
Status published Medium CVE-2025-62517

Rollbar.js Prototype Pollution Vulnerability in merge()

Vulnerability Description

Rollbar.js offers error tracking and logging from Javascript to Rollbar. In versions before 2.26.5 and from 3.0.0-alpha1 to before 3.0.0-beta5, there is a prototype pollution vulnerability in merge(). If application code calls rollbar.configure() with untrusted input, prototype pollution is possible. This issue has been fixed in versions 2.26.5 and 3.0.0-beta5. A workaround involves ensuring that values passed to rollbar.configure() do not contain untrusted input.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-62517

Credits & Attribution

No credits recorded in the NVD database.

References

More from rollbar

View All →
CVE-2025-32250
WordPress Rollbar plugin <= 2.7.1 - Cross Site Request Forgery (CSRF) vulnerability
Medium 5.4

Affected Vendor

Affected Software

rollbar.js
Vulnerable Versions:
< 2.26.5, >= 3.0.0-alpha1, < 3.0.0-beta5

Timeline

Official Publish: October 23rd, 2025
Last Modified: October 23rd, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Weaknesses (CWE)

CWE-1321

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.