CompileError: WebAssembly.instantiate(): Refused to compile or instantiate WebAssembly module

[RiccardoRiggi]

Good morning, since January 20, 2025 we have encountered a blocking bug that prevents the rendering of PDF files:

Uncaught (in promise) RuntimeError: Aborted(CompileError: WebAssembly.instantiate(): Refused to compile or instantiate WebAssembly module because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "default-src 'self' http: https: ws: wss: data: blob: 'unsafe-inline'"). Build with -sASSERTIONS for more info.

Desktop (please complete the following information):

• OS: Windows
• Browser Chrome not work (v. 131), Firefox at the moment yes
• React-pdf version a lot, like (3.1.9, 3.1.2, 4.1.6, )

We would like to avoid changing CSP policies to protect our applications from xss vulnerabilities

Do you know how to help us? Thank you in advance

[leotankilevich]

How is it going?

[didemkkaslan]

Same issue

[buzzo123]

same

[mayanksaxena]

Same issue! Did anyone find any solution? Please help.

[etanb]

Same issue here -- this seems prevalent across multiple projects. And has been opened multiple times on this repo: #2596 #510 #2815

Sorry for the direct tag but @diegomura any idea if there will be a legit fix to this problem? 🙏

[keptaduona]

Hello, having the same issue, any updates on this?

[nistalhelmuth]

Same issue, any updates?

[hikitahero]

still the same

[noahgrant]

One thing that worked for me was upgrading @react-pdf/renderer to v4.3 (so that we can upgrade to React 19) but pinning @react-pdf/textkit to v4.2 and @react-pdf/layout to v3.6 (which were their respective versions for v3 of @react-pdf/renderer). The unsafe-eval is happening in one of those other packages' newer versions.

[M-AhmedSajid]

+1