CVE-2026-106104 in Quasar
Summary
by MITRE • 10/06/2026
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.23.3, Platform.parseSSR() passed an unbounded User-Agent request header to getMatch() in ui/src/plugins/platform/Platform.js, whose browser-detection expressions combined greedy captures with repeated unbounded scans. Platform belongs to autoInstalledPlugins, so this parsing occurs before routing for every SSR request. A crafted unauthenticated request containing repeated version tokens without a terminating Safari token causes super-linear backtracking and blocks the Node.js event loop, delaying every other SSR request. SPA, PWA, Electron, Cordova, Capacitor, browser-extension, and static-site-generation targets are not affected because they do not parse an attacker-controlled request header through this path. This issue is fixed in version 2.23.3.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/06/2026
The Quasar Framework, a popular tool for developing high-performance Vue.js user interfaces, contains a critical server-side rendering vulnerability that impacts the availability of applications relying on its platform detection mechanisms. Specifically, within versions prior to 2.23.3, the Platform.parseSSR function processes incoming HTTP requests by extracting and analyzing the User-Agent header string. This processing is part of an auto-installed plugin system, meaning it executes automatically for every server-side rendered request before routing logic determines how to handle the page. The core technical flaw lies in the implementation of browser-detection regular expressions within this parsing routine. These expressions utilize greedy capture groups combined with repeated unbounded quantifiers when scanning the User-Agent string. This specific combination creates a scenario where the regex engine can enter a state of catastrophic backtracking if presented with maliciously crafted input that triggers excessive recursive matching attempts without finding a terminating condition, such as a standard Safari token in this context.
From an operational perspective, this vulnerability manifests as a ReDoS or Regular Expression Denial of Service attack vector. When an unauthenticated attacker sends a request containing repeated version tokens designed to exploit the greedy backtracking behavior, the Node.js event loop becomes blocked due to the excessive CPU cycles required by the regex engine. This blockage prevents the server from processing other concurrent requests, effectively causing a denial of service for all users attempting to access the application during the attack window. The impact is strictly limited to Server-Side Rendering targets; environments such as Single Page Applications, Progressive Web Apps, Electron apps, Cordova applications, Capacitor projects, browser extensions, and static-site-generation builds are not affected because they do not parse attacker-controlled request headers through this specific server-side code path.
This vulnerability aligns with CWE-400, which describes Uncontrolled Resource Consumption, as the application fails to limit the resources consumed by processing a single input string. It also maps to MITRE ATT&CK technique T1496, Host Denial of Service, where an adversary disrupts service availability through resource exhaustion rather than system compromise or data theft. The attack requires no authentication and can be executed remotely via standard HTTP requests targeting the SSR endpoint. To mitigate this risk, organizations using Quasar Framework must upgrade to version 2.23.3 or later, which addresses the regex complexity by optimizing the browser-detection expressions to prevent unbounded backtracking. Until an update is applied, administrators should consider implementing rate limiting on incoming requests and filtering User-Agent headers at a reverse proxy level to block patterns known to trigger excessive computational load in vulnerable regular expression engines.