rollbar vulnerable to Prototype Pollution in merge()

Description

Prototype pollution vulnerability in merge(). If application code calls rollbar.configure() with untrusted input, prototype pollution is possible.

Recommendation

Update the rollbar package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 3.0.0-alpha1, <= 3.0.0-beta4

  <= 2.26.4**

• Patched version(s): **3.0.0-beta5

  2.26.5**

References

• GHSA-xcg2-9pp4-j82x
• CVE-2025-62517
• CWE-1321
• CAPEC-310
• OWASP 2021-A6

Related Issues

• rollbar vulnerable to prototype pollution - CVE-2025-57325
• mpregular vulnerable to prototype pollution - CVE-2025-57323
• min-document vulnerable to prototype pollution - CVE-2025-57352
• parse is vulnerable to prototype pollution - CVE-2025-57324

Tags:

npm

rollbar