CVE-2026-106105: @quasar/ssl-certificate Development TLS Key Caching Vulnerability
Summary
CVE-2026-106105: Quasar Framework: Development TLS private keys are cached with overly permissive filesystem permissions. Affects @quasar/ssl-certificate versions < 2.1.0. Fixed in 2.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @quasar/ssl-certificate package is a development utility within the Quasar Framework that facilitates the creation and management of SSL certificates for local development environments. It is designed to streamline the process of setting up secure HTTPS connections during development. However, this package has a critical vulnerability that allows sensitive private keys to be cached with overly permissive filesystem permissions, potentially exposing them to unauthorized local users.
Vulnerability Detail
The vulnerability arises from the caching mechanism of the @quasar/ssl-certificate package, which stores a combined PEM file containing both a generated private key and certificate without adequately restricting access permissions. This oversight means that on systems with a typical process umask, the PEM file can be read by other local users. A local attacker with filesystem access could exploit this vulnerability to copy and reuse the private key, allowing them to impersonate a development TLS endpoint in environments that trust the certificate. Additionally, the generated certificate was unnecessarily CA-capable and included broad key usages beyond its intended localhost HTTPS purpose, further exacerbating the risk.
How To Fix
Latest published version: 2.1.0 as of 23 Oct 2026
npm install @quasar/ssl-certificate@2.1.0The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can manually change the permissions of the cached PEM file to restrict access. Use the following command to set the permissions to owner-only:
chmod 600 path/to/cached.pem
Replace 'path/to/cached.pem' with the actual path to your cached PEM file.
Conclusion
The @quasar/ssl-certificate package has a significant vulnerability that allows sensitive private keys to be cached with overly permissive permissions, posing a risk to local development environments. It is crucial to update to the patched versions of the affected packages to mitigate this risk and ensure secure development practices.
See every vulnerability recorded for @quasar/ssl-certificate →
FAQ
The CVSS score of this vulnerability is 8.4, indicating a high severity level.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Without requiring access to the code or installation, Vulert uses just package-lock.json to provide real-time alerts. You can also check your application using the Vulert playground at Vulert Scanner.
If exploited, a local attacker could impersonate a development TLS endpoint, potentially leading to data interception or unauthorized access to sensitive information.
Yes, this vulnerability primarily affects local development environments where the cached PEM file can be accessed by other local users.
If you cannot update the packages right away, ensure to restrict access to the cached PEM file using the chmod command as a temporary measure.
