CVE-2026-106104: Quasar Framework Super-linear Regex Backtracking Vulnerability
Summary
CVE-2026-106104: One unauthenticated request with a crafted User-Agent stalls a Quasar SSR server for seconds. Affects quasar versions < 2.23.3. Fixed in 2.23.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Quasar Framework is a popular open-source framework for building Vue.js applications, providing a rich set of features for developing responsive web applications. It includes server-side rendering (SSR) capabilities, allowing developers to create fast and SEO-friendly applications. However, a vulnerability has been identified in its Platform plugin, which can lead to significant performance degradation under certain conditions.
Vulnerability Detail
The vulnerability arises from the way the Quasar Framework's Platform plugin processes the 'User-Agent' HTTP header during server-side rendering. A crafted 'User-Agent' string can cause super-linear regex backtracking in the regex engine, leading to excessive CPU consumption and stalling the Node.js event loop. This can result in denial of service, as legitimate requests are queued behind the malicious one. The regex patterns used are unbounded and greedy, allowing an attacker to exploit this by sending a specially crafted header that takes an inordinate amount of time to process.
How To Fix
Latest published version: 2.35.2 as of 23 Oct 2026
npm install quasar@2.35.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.23.3
This is the first release that contains the fix.
npm install quasar@2.23.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can limit the length of the 'User-Agent' header processed by the server. Modify the parseSSR function in the Platform plugin to slice the 'User-Agent' string to a maximum length, for example:
I.parseSSR = e => {
let t = e.req.headers['user-agent'] || e.req.headers['User-Agent'] || '';
return {...F, userAgent: t.slice(0, 512), is: P(t.slice(0, 512))};
};
Conclusion
The Quasar Framework vulnerability CVE-2026-106104 poses a significant risk due to its potential for denial of service through regex backtracking. It is crucial for developers using this framework to update to version 2.23.3 or later to mitigate this risk. Implementing the provided workaround can also help in the interim.
See every vulnerability recorded for quasar →
FAQ
The CVSS score of this vulnerability is 8.7, indicating a high severity level.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
The vulnerability can lead to denial of service, where legitimate users experience significant delays or are unable to access the application due to the event loop being blocked by a malicious request.
No, the vulnerability is specific to server-side rendering (SSR) and does not affect client-side rendering, as the 'User-Agent' string is controlled by the browser.
If an immediate update is not possible, implement the suggested workaround to limit the length of the 'User-Agent' header until you can upgrade to the patched version.
References
Related vulnerabilities
Recent vulnerabilities recorded for quasar.
