VYPR
Get started
← All advisories
Medium severity5.9OSV Advisory· Published Oct 23, 2025· Updated Apr 15, 2026

CVE-2025-62517

CVE-2025-62517

Description

Rollbar.js offers error tracking and logging from Javascript to Rollbar. In versions before 2.26.5 and from 3.0.0-alpha1 to before 3.0.0-beta5, there is a prototype pollution vulnerability in merge(). If application code calls rollbar.configure() with untrusted input, prototype pollution is possible. This issue has been fixed in versions 2.26.5 and 3.0.0-beta5. A workaround involves ensuring that values passed to rollbar.configure() do not contain untrusted input.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
rollbarnpm
< 2.26.52.26.5
rollbarnpm
>= 3.0.0-alpha1, < 3.0.0-beta53.0.0-beta5

Affected products

1

Patches

2
d717def8b68f

prototype pollution prevention (#1394)

https://github.com/rollbar/rollbar.jsWalt JonesOct 17, 2025via ghsa
commit
4 files changed · +21 −4
  • .github/workflows/ci.yml+3 −3 modified
    @@ -2,14 +2,14 @@ name: Rollbar.js CI
 
 on:
   push:
-    branches: [master]
+    branches: [next/2.x/main]
     tags: [v*]
   pull_request:
-    branches: [master]
+    branches: [next/2.x/main]
 
 jobs:
   build:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-22.04
 
     strategy:
       matrix:
  • src/merge.js+1 −1 modified
    @@ -34,7 +34,7 @@ function merge() {
     copy,
     clone,
     name,
-    result = {},
+    result = Object.create(null), // no prototype pollution on Object
     current = null,
     length = arguments.length;
  • src/utility.js+4 −0 modified
    @@ -660,6 +660,10 @@ function set(obj, path, value) {
   if (!obj) {
     return;
   }
+
+  // Prevent prototype pollution by setting the prototype to null.
+  Object.setPrototypeOf(obj, null);
+
   var keys = path.split('.');
   var len = keys.length;
   if (len < 1) {
  • test/utility.test.js+13 −0 modified
    @@ -446,6 +446,13 @@ describe('merge', function () {
     expect(e.amihere).to.eql('yes');
     done();
   });
+  it('should be secure against prototype pollution', function () {
+    const o1 = JSON.parse('{"__proto__": {"polluted": "yes"}}');
+    const o2 = JSON.parse('{"__proto__": {"polluted": "yes"}}');
+    const result = _.merge(o1, o2);
+    expect({}.polluted).to.not.eql('yes');
+    expect(result.polluted).to.not.eql('yes');
+  });
 });
 
 var traverse = require('../src/utility/traverse');
@@ -765,6 +772,12 @@ describe('set', function () {
     expect(o.foo.bar.buzz).to.eql(97);
     expect(o.foo.bar.baz.fizz).to.eql(1);
   });
+  it('should be secure against prototype pollution', function () {
+    const o = {};
+    _.set(o, '__proto__.polluted', 'yes');
+    expect({}.polluted).to.not.eql('yes');
+    expect(o.polluted).to.not.eql('yes');
+  });
 });
 
 var scrub = require('../src/scrub');
61032fe6c208

prototype pollution prevention (#1390)

https://github.com/rollbar/rollbar.jsWalt JonesOct 16, 2025via ghsa
commit
3 files changed · +18 −1
  • src/merge.js+1 −1 modified
    @@ -32,7 +32,7 @@ function merge() {
     copy,
     clone,
     name,
-    result = {},
+    result = Object.create(null), // no prototype pollution on Object
     current = null,
     length = arguments.length;
  • src/utility.js+4 −0 modified
    @@ -666,6 +666,10 @@ function set(obj, path, value) {
   if (!obj) {
     return;
   }
+
+  // Prevent prototype pollution by setting the prototype to null.
+  Object.setPrototypeOf(obj, null);
+
   var keys = path.split('.');
   var len = keys.length;
   if (len < 1) {
  • test/utility.test.js+13 −0 modified
    @@ -299,6 +299,13 @@ describe('merge', function () {
     expect(e.amihere).to.eql('yes');
     done();
   });
+  it('should be secure against prototype pollution', function () {
+    const o1 = JSON.parse('{"__proto__": {"polluted": "yes"}}');
+    const o2 = JSON.parse('{"__proto__": {"polluted": "yes"}}');
+    const result = _.merge(o1, o2);
+    expect({}.polluted).to.not.eql('yes');
+    expect(result.polluted).to.not.eql('yes');
+  });
 });
 
 import traverse from '../src/utility/traverse.js';
@@ -570,6 +577,12 @@ describe('set', function () {
     expect(o.foo.bar.buzz).to.eql(97);
     expect(o.foo.bar.baz.fizz).to.eql(1);
   });
+  it('should be secure against prototype pollution', function () {
+    const o = {};
+    _.set(o, '__proto__.polluted', 'yes');
+    expect({}.polluted).to.not.eql('yes');
+    expect(o.polluted).to.not.eql('yes');
+  });
 });
 
 import scrub from '../src/scrub.js';

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

7

News mentions

0

No linked articles in our index yet.