Is CVE-2025-57325 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-57325 being exploited in the wild.

How severe is CVE-2025-57325?

Medium severity, with a CVSS score of 4, published 20 October 2025.

Which products and versions are affected?

rollbar (npm) SEMVER:introduced=0,fixed=2.26.5.

Is there a fix for CVE-2025-57325?

Yes. rollbar (npm): upgrade to 2.26.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-57325 attacked?

It is attacked over the network.

Am I affected by CVE-2025-57325?

Check whether you run rollbar (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-57325: Rollbar prototype pollution in utility function

CVE-2025-57325 · Severity: medium · CVSS 4 · Published 2025-10-20

Rollbar's JavaScript library contains a prototype pollution vulnerability in an internal utility function. While the public API is not affected, applications that directly import and use the internal `set()` function from rollbar with untrusted input could allow attackers to pollute object prototypes, potentially affecting application behavior or security. This primarily impacts developers using undocumented internal APIs rather than standard Rollbar usage.

Technologies: rollbar (npm). Vendors: npm.

Quick answers

Is CVE-2025-57325 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-57325 being exploited in the wild.
How severe is CVE-2025-57325?: Medium severity, with a CVSS score of 4, published 20 October 2025.
Which products and versions are affected?: rollbar (npm) SEMVER:introduced=0,fixed=2.26.5.
Is there a fix for CVE-2025-57325?: Yes. rollbar (npm): upgrade to 2.26.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-57325 attacked?: It is attacked over the network.
Am I affected by CVE-2025-57325?: Check whether you run rollbar (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

rollbar (npm): upgrade to 2.26.5 or later
```
npm install rollbar@2.26.5
```

Technical details

A prototype pollution vulnerability exists in the rollbar/src/utility.set() function, which fails to sanitize property names in the second argument. When called with attacker-controlled input containing proto-pollution payloads (e.g., "__proto__.property"), the function modifies the Object prototype chain. The vulnerability requires direct import of the internal utility function—not exposed in the public API—and untrusted input to the key parameter. An attacker can pollute object prototypes to modify default behavior across the application. The vulnerability is fixed in versions 2.26.5 and 3.0.0-beta5. Versions ≤2.26.4 and ≥3.0.0-alpha1 and ≤3.0.0-beta4 are affected.

Affected products

Rollbar rollbar <=2.26.4, >=3.0.0-alpha1 and <=3.0.0-beta4

Identifiers

CVE-2025-57325
GHSA-r8c2-2qwq-94p6

Timeline

2025-10-20: disclosed
2025-10-20: patched: Fixed in versions 2.26.5 and 3.0.0-beta5

References

https://github.com/rollbar/rollbar.js/security/advisories/GHSA-r8c2-2qwq-94p6

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.