Description
All dynamically loaded chunks receive an invalid integrity hash that is ignored by the browser, and therefore the browser cannot validate their integrity. This removes the additional level of protection offered by SRI for such chunks. Top-level chunks are unaffected.
Recommendation
Update the webpack-subresource-integrity package to the latest compatible version. Followings are version details:
- Affected version(s): < 1.5.1
- Patched version(s): 1.5.1
References
Could your website be exposed too?
SmartScanner can check your website for Unprotected dynamically loaded chunks and gives you actionable findings to investigate.
Start a free scanRelated Issues
- flat vulnerable to Prototype Pollution - CVE-2020-36632
- Prototype pollution vulnerability in 'libnested - CVE-2020-28283
- MJML allows mj-include directory traversal due to an incomplete fix for CVE-2020-12827 - CVE-2025-67898
- Server-Side Template Injection in formio - CVE-2020-28246
You might also like:
See something that needs correcting? Let us knowUpdated February 01, 2023