{"cve":"CVE-2020-15262","nvd":{"published":"2020-10-19T20:15:12.667","modified":"2026-06-17T02:56:23.150","status":"Modified","description":"In webpack-subresource-integrity before version 1.5.1, all dynamically loaded chunks receive an invalid integrity hash that is ignored by the browser, and therefore the browser cannot validate their integrity. This removes the additional level of protection offered by SRI for such chunks. Top-level chunks are unaffected. This issue is patched in version 1.5.1.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","score":3.7},"cwes":["CWE-345"],"references":["https://github.com/waysact/webpack-subresource-integrity/commit/3d7090c08c333fcfb10ad9e2d6cf72e2acb7d87f","https://github.com/waysact/webpack-subresource-integrity/issues/131","https://github.com/waysact/webpack-subresource-integrity/security/advisories/GHSA-4fc4-chg7-h8gh","https://github.com/waysact/webpack-subresource-integrity/commit/3d7090c08c333fcfb10ad9e2d6cf72e2acb7d87f","https://github.com/waysact/webpack-subresource-integrity/issues/131"],"products":["webpack-subresource-integrity_project:webpack-subresource-integrity"],"source":"nvd","synced_at":"2026-10-19T21:09:53.489947993+00:00"},"epss":{"cve":"CVE-2020-15262","score":0.00519,"percentile":0.44168,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-4fc4-chg7-h8gh","url":"https://osv.dev/vulnerability/GHSA-4fc4-chg7-h8gh","summary":"Unprotected dynamically loaded chunks","modified":"2026-07-08T06:28:14.210457449Z","packages":[{"ecosystem":"npm","name":"webpack-subresource-integrity","purl":"pkg:npm/webpack-subresource-integrity","ranges":["<1.5.1"],"fixed":["1.5.1"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}