rollbar is a package designed to effortlessly track and debug errors in JavaScript…
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub.
Summary
rollbar is a package designed to effortlessly track and debug errors in JavaScript applications. This package includes advanced error tracking features and an intuitive interface to help you identify and fix issues more quickly. A Prototype Pollution vulnerability in the utility.set function of rollbar v2.26.4 and before allows attackers to inject properties on Object.prototype via supplying a crafted payload, causing denial of service (DoS) as the minimum consequence.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | rollbar (npm) | before 2.26.5 | 2.26.5 | Patch available | GHSA-r8c2-2qwq-94p6 |
| — | rollbar (npm) | 3.0.0-alpha1 to before 3.0.0-beta5 | 3.0.0-beta5 | Patch available | GHSA-r8c2-2qwq-94p6 |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- rollbar (npm) Vendor— Affected before 2.26.5 Fixed in 2.26.5 Patch available GHSA-r8c2-2qwq-94p6
- rollbar (npm) Vendor— Affected 3.0.0-alpha1 to before 3.0.0-beta5 Fixed in 3.0.0-beta5 Patch available GHSA-r8c2-2qwq-94p6
Remediation
- Fix · GHSA-r8c2-2qwq-94p6 rollbar (npm) Fixed in 2.26.5 Advisory →
- Fix · GHSA-r8c2-2qwq-94p6 rollbar (npm) Fixed in 3.0.0-beta5 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-57325
- 2026-10-03 Alias added: GHSA-r8c2-2qwq-94p6
References
Advisory 2
Other 5
- https://github.com/VulnSageAgent/PoCs/blob/main/JavaScript/prototype-pollution/rollbar%402.26.4/index.js
- https://github.com/rollbar/rollbar.js/security/advisories/GHSA-r8c2-2qwq-94p6
- https://github.com/rollbar/rollbar.js/issues/1333
- https://github.com/rollbar/rollbar.js/commit/d717def8b68f4a947975d0aebb729869cdb2d343
- https://github.com/rollbar/rollbar.js
Sources
- CVE-2025-57325 · CVE Program
- CVE-2025-57325 · NVD
- FIRST EPSS
- GHSA-r8c2-2qwq-94p6 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences