Rollbar.js Prototype Pollution Vulnerability in merge()

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2025-62517 · Microsoft / collected KEV context

EUVD-2025-35708

GHSA-xcg2-9pp4-j82x

cve-program · CVE-2025-62517

• https://github.com/rollbar/rollbar.js/security/advisories/GHSA-xcg2-9pp4-j82x
• https://github.com/rollbar/rollbar.js/pull/1390
• https://github.com/rollbar/rollbar.js/pull/1394
• https://github.com/rollbar/rollbar.js/commit/61032fe6c208b71e249514800808a54bcb8cb8bb
• https://github.com/rollbar/rollbar.js/commit/d717def8b68f4a947975d0aebb729869cdb2d343

euvd · EUVD-2025-35708

• https://github.com/rollbar/rollbar.js/security/advisories/GHSA-xcg2-9pp4-j82x
• https://github.com/rollbar/rollbar.js/pull/1390
• https://github.com/rollbar/rollbar.js/pull/1394
• https://github.com/rollbar/rollbar.js/commit/61032fe6c208b71e249514800808a54bcb8cb8bb
• https://github.com/rollbar/rollbar.js/commit/d717def8b68f4a947975d0aebb729869cdb2d343

nvd · CVE-2025-62517

• https://github.com/rollbar/rollbar.js/commit/61032fe6c208b71e249514800808a54bcb8cb8bb
• https://github.com/rollbar/rollbar.js/commit/d717def8b68f4a947975d0aebb729869cdb2d343
• https://github.com/rollbar/rollbar.js/pull/1390
• https://github.com/rollbar/rollbar.js/pull/1394
• https://github.com/rollbar/rollbar.js/security/advisories/GHSA-xcg2-9pp4-j82x

osv · GHSA-xcg2-9pp4-j82x

• https://github.com/rollbar/rollbar.js/security/advisories/GHSA-xcg2-9pp4-j82x
• https://nvd.nist.gov/vuln/detail/CVE-2025-62517
• https://github.com/rollbar/rollbar.js/pull/1390
• https://github.com/rollbar/rollbar.js/pull/1394
• https://github.com/rollbar/rollbar.js/commit/61032fe6c208b71e249514800808a54bcb8cb8bb
• https://github.com/rollbar/rollbar.js/commit/d717def8b68f4a947975d0aebb729869cdb2d343
• https://github.com/rollbar/rollbar.js

No related operational record is retained in the current change model.