CVE-2020-15262 Details
Description
In webpack-subresource-integrity before version 1.5.1, all dynamically loaded chunks receive an invalid integrity hash that is ignored by the browser, and therefore the browser cannot validate their integrity. This removes the additional level of protection offered by SRI for such chunks. Top-level chunks are unaffected. This issue is patched in version 1.5.1.
A vulnerability exists in the webpack-subresource-integrity plugin, specifically in version 1.5.0, where dynamically loaded chunks are assigned an incorrect integrity hash. This flaw prevents browsers from properly validating the integrity of these chunks, thereby undermining the additional protection that Subresource Integrity (SRI) is meant to provide. In contrast, top-level chunks remain unaffected. The issue arises from a bug introduced in version 1.5.0, which was later corrected in version 1.5.1.
Upgrade to webpack-subresource-integrity version 1.5.1, which addresses the integrity hash lookup for dynamic chunks. After upgrading, ensure that any cached versions of the files are cleared or bumped to allow the browser to fetch the updated scripts with the correct integrity values.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/waysact/webpack-subresource-integrity/commit/3d7090c08c333fcfb10ad9e2d6cf72e2acb7d87f | CVE | PatchThird Party Advisory |
| https://github.com/waysact/webpack-subresource-integrity/issues/131 | CVE | Third Party Advisory |
| https://github.com/waysact/webpack-subresource-integrity/security/advisories/GHSA-4fc4-chg7-h8gh | CVE | Third Party Advisory |
| https://github.com/waysact/webpack-subresource-integrity/commit/3d7090c08c333fcfb10ad9e2d6cf72e2acb7d87f | [email protected] | PatchThird Party Advisory |
| https://github.com/waysact/webpack-subresource-integrity/issues/131 | [email protected] | Third Party Advisory |
| https://github.com/waysact/webpack-subresource-integrity/security/advisories/GHSA-4fc4-chg7-h8gh | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-345 | Insufficient Verification of Data Authenticity | [email protected] |
| CWE-345 | Insufficient Verification of Data Authenticity | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| webpack-subresource-integrity project webpack-subresource-integrity | < 1.5.1 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Nov 21, 2024 | CVE Modified | CVE |
| May 14, 2024 | CVE Modified | [email protected] |
| Nov 18, 2021 | Reanalysis | [email protected] |
| Oct 29, 2020 | Initial Analysis | [email protected] |
| Oct 19, 2020 | CVE Modified | [email protected] |