CVE-2020-15262
Invalid integrity hashes in webpack-subresource-integrity
In webpack-subresource-integrity before version 1.5.1, all dynamically loaded chunks receive an invalid integrity hash that is ignored by the browser, and therefore the browser cannot validate their integrity. This removes the additional level of protection offered by SRI for such chunks. Top-level chunks are unaffected. This issue is patched in version 1.5.1.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Invalid integrity hashes in webpack-subresource-integrity
In webpack-subresource-integrity before version 1.5.1, all dynamically loaded chunks receive an invalid integrity hash that is ignored by the browser, and therefore the browser cannot validate their integrity. This removes the additional level of protection offered by SRI for such chunks. Top-level chunks are unaffected. This issue is patched in version 1.5.1.
- Record
CVE-2020-15262- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-345
- Updated
- 2026-11-02
EUVDEUVD-2020-1406
In webpack-subresource-integrity before version 1.5.1, all dynamically loaded chunks receive an invalid integrity hash that is ignored by the browser, and therefore the browser cannot validate their integrity. This removes the additional level of protection offered by SRI for such chunks. Top-level chunks are unaffected. This issue is patched in version 1.5.1.
- Record
EUVD-2020-1406- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4fc4-chg7-h8gh
Unprotected dynamically loaded chunks
Impact
All dynamically loaded chunks receive an invalid integrity hash that is ignored by the browser, and therefore the browser cannot validate their integrity. This removes the additional level of protection offered by SRI for such chunks. Top-level chunks are unaffected.
Patches
This issue is patched in version 1.5.1.
Workarounds
N/A
References
https://github.com/waysact/webpack-subresource-integrity/issues/131
For more information
If you have any questions or comments about this advisory:
- Comment on webpack-subresource-integrity issue #131
- Or email us at [email protected]
- Record
GHSA-4fc4-chg7-h8gh- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-345
- Updated
- 2026-11-02
NVD
In webpack-subresource-integrity before version 1.5.1, all dynamically loaded chunks receive an invalid integrity hash that is ignored by the browser, and therefore the browser cannot validate their integrity. This removes the additional level of protection offered by SRI for such chunks. Top-level chunks are unaffected. This issue is patched in version 1.5.1.
- Record
CVE-2020-15262- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-345
- Updated
- 2026-11-02
OSV
In webpack-subresource-integrity before version 1.5.1, all dynamically loaded chunks receive an invalid integrity hash that is ignored by the browser, and therefore the browser cannot validate their integrity. This removes the additional level of protection offered by SRI for such chunks. Top-level chunks are unaffected. This issue is patched in version 1.5.1.
- Record
CVE-2020-15262- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-4fc4-chg7-h8gh
Unprotected dynamically loaded chunks
Impact
All dynamically loaded chunks receive an invalid integrity hash that is ignored by the browser, and therefore the browser cannot validate their integrity. This removes the additional level of protection offered by SRI for such chunks. Top-level chunks are unaffected.
Patches
This issue is patched in version 1.5.1.
Workarounds
N/A
References
https://github.com/waysact/webpack-subresource-integrity/issues/131
For more information
If you have any questions or comments about this advisory:
- Comment on webpack-subresource-integrity issue #131
- Or email us at [email protected]
- Record
GHSA-4fc4-chg7-h8gh- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-345
- Updated
- 2026-11-02
OSVCLSA-2026-1774225212 No score
TuxCare security update for webpack-subresource-integrity (1 CVE)
TuxCare rebuilt webpack-subresource-integrity to address 1 CVE. Fixed in 1.4.0-tuxcare.1.
- Record
CLSA-2026-1774225212- Updated
- 2026-11-02
OSVCLSA-2026-1779238044 No score
TuxCare security update for webpack-subresource-integrity (1 CVE)
TuxCare rebuilt webpack-subresource-integrity to address 1 CVE. Fixed in 1.4.1-tuxcare.1.
- Record
CLSA-2026-1779238044- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
webpack-subresource-integritynpm |
before 1.5.1 | 1.5.1 |
webpack-subresource-integrityTuxCare:npm |
1.4.0-tuxcare.0 up to 1.4.0-tuxcare.1, plus listed versions 1.4.0 |
1.4.0-tuxcare.1 |
webpack-subresource-integrityTuxCare:npm |
1.4.1-tuxcare.0 up to 1.4.1-tuxcare.1, plus listed versions 1.4.1 |
1.4.1-tuxcare.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-15262 is a low vulnerability (CVSS 3.7) in Waysact Webpack-subresource-integrity, published October 19, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.52%, the 44th percentile. Fixed in webpack-subresource-integrity 1.5.1.
References
github.com/waysact/webpack-subresource-integrity/security/advisories/GHSA-4fc4-chg7-h8gh
nvd.nist.gov/vuln/detail/CVE-2020-15262