CVE-2026-106106: Quasar Framework SSR/SSG Dev Error Page Exposes Sensitive Environment Variables
Summary
CVE-2026-106106: The error page that Quasar CLI shows when an SSR or SSG render throws in development serializes every variable in process.env, every request header and every cookie into the HTTP response, and the dev server binds 0.0.0.... Affects @quasar/render-ssr-error versions < 2.2.4. Fixed in 2.2.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Quasar Framework is a popular open-source framework for building Vue.js applications. It provides a powerful CLI and supports server-side rendering (SSR) and static site generation (SSG). However, a vulnerability exists in its development server that can expose sensitive information when an error occurs during rendering.
Vulnerability Detail
The vulnerability arises from the error page generated by the Quasar CLI during SSR or SSG development. This page serializes sensitive information, including all environment variables, request headers, and cookies, into the HTTP response. The server listens on '0.0.0.0', allowing any host on the network to access this information. Additionally, the escape mechanism used to prevent script injection is flawed, allowing attackers to execute scripts in the developer's browser. This could lead to exposure of cloud keys, registry tokens, and database URLs.
How To Fix
Latest published version: 2.2.6 as of 23 Oct 2026
npm install @quasar/render-ssr-error@2.2.6Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.2.4
This is the first release that contains the fix.
npm install @quasar/render-ssr-error@2.2.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the development server by binding it to 'localhost' instead of '0.0.0.0'. Modify the Quasar configuration file to set the devServer host:
if (!cfg.devServer.host) {
cfg.devServer.host = 'localhost';
}
Conclusion
The Quasar Framework vulnerability CVE-2026-106106 poses a significant risk by exposing sensitive information through its development error page. It is crucial to update to the patched versions of the affected packages and implement workarounds to mitigate the risk until updates can be applied.
See every vulnerability recorded for @quasar/render-ssr-error →
FAQ
The CVSS score of this vulnerability is 7.1, indicating a high severity level.
The vulnerability exposes sensitive environment variables, request headers, and cookies, which may include cloud credentials and database connection strings.
No, this vulnerability only exists in development builds, as the error page is not present in production.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring signup.
If immediate updates are not possible, ensure that the development server is not accessible from external networks by binding it to 'localhost'.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
