CVE-2026-106104High· 8.7▾ MidnightPoC availableQuasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.23.3, Platform.parseSSR() passed an unbounded User-Agent request header to getMatch() in ui/src/plugins/platform/Platform.js, whose browser-…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 47.8 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
Last analysed / modified upstream
Exploit / PoC code exists
0.3% → 0.4%
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.23.3, Platform.parseSSR() passed an unbounded User-Agent request header to getMatch() in ui/src/plugins/platform/Platform.js, whose browser-detection expressions combined greedy captures with repeated unbounded scans. Platform belongs to autoInstalledPlugins, so this parsing occurs before routing for every SSR request. A crafted unauthenticated request containing repeated version tokens without a terminating Safari token causes super-linear backtracking and blocks the Node.js event loop, delaying every other SSR request. SPA, PWA, Electron, Cordova, Capacitor, browser-extension, and static-site-generation targets are not affected because they do not parse an attacker-controlled request header through this path. This issue is fixed in version 2.23.3.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
quasar <= 2.23.2Patched in:
quasar 2.23.3Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-106106High· 7.1Quasar Framework is a framework for building high-performance Vue.js user interfaces
CVE-2026-106101Low· 3.1Quasar Framework is a framework for building high-performance Vue.js user interfaces
CVE-2026-106103High· 7.1Quasar Framework is a framework for building high-performance Vue.js user interfaces
CVE-2026-106107High· 8.3Quasar Framework is a framework for building high-performance Vue.js user interfaces
CVE-2026-106109Medium· 4.1Quasar Framework is a framework for building high-performance Vue.js user interfaces
CVE-2026-106105High· 8.4Quasar Framework is a framework for building high-performance Vue.js user interfaces