quasarframework Quasar up to 2.23.2 SSR Parsing Platform.js Platform.parseSSR User-Agent infinite loop

Summaryinfo

A vulnerability was found in quasarframework Quasar up to 2.23.2. It has been declared as problematic. Impacted is the function Platform.parseSSR of the file ui/src/plugins/platform/Platform.js of the component SSR Parsing. Executing a manipulation of the argument User-Agent can lead to infinite loop. The identification of this vulnerability is CVE-2026-106104. The attack may be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability has been found in quasarframework Quasar up to 2.23.2 and classified as problematic. This vulnerability affects the function Platform.parseSSR of the file ui/src/plugins/platform/Platform.js of the component SSR Parsing. The manipulation of the argument User-Agent with an unknown input leads to a infinite loop vulnerability. The CWE definition for the vulnerability is CWE-835. The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop. As an impact it is known to affect availability. CVE summarizes:

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.23.3, Platform.parseSSR() passed an unbounded User-Agent request header to getMatch() in ui/src/plugins/platform/Platform.js, whose browser-detection expressions combined greedy captures with repeated unbounded scans. Platform belongs to autoInstalledPlugins, so this parsing occurs before routing for every SSR request. A crafted unauthenticated request containing repeated version tokens without a terminating Safari token causes super-linear backtracking and blocks the Node.js event loop, delaying every other SSR request. SPA, PWA, Electron, Cordova, Capacitor, browser-extension, and static-site-generation targets are not affected because they do not parse an attacker-controlled request header through this path. This issue is fixed in version 2.23.3.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-106104 since 10/06/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1499.

Upgrading to version 2.23.3 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• quasarframework

Name

• Quasar

Version

• 2.23.0
• 2.23.1
• 2.23.2

Website

• Product: https://github.com/quasarframework/quasar/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion