Quasar Framework: Super-linear regex backtracking in SSR User-Agent parsing
Summary
Quasar Framework, a Vue.js framework, parses the HTTP User-Agent header with inefficient regular expressions during server-side rendering (SSR). A single unauthenticated request with a crafted User-Agent can block the Node.js event loop and delay all other SSR requests. Only SSR builds are affected; SPA, PWA, Electron, Cordova, Capacitor, browser-extension and static-site-generation targets are not.
Affected
- Quasar Framework (npm package quasar) versions before 2.23.3, SSR builds only
- Versions 1.x are listed in scanner data but not verified; check manually
Fixed in
- Fixed in version 2.23.3
- Vendor advisory GHSA-68jq-fhch-4xq4 and fix commit 7a954dd
Workaround
- Limit the length of the User-Agent header at a reverse proxy or WAF (not vendor guidance, not tested)
- Apply rate limiting to SSR endpoints
- Restarting the Node process only helps temporarily
Exploitation
- Unknown whether exploited in the wild; not marked as known exploited at the time of research
- Public technical details exist: a downstream pull request reproduces the vulnerable code path
- CISA SSVC: exploitation PoC, automatable: yes, technical impact: total
Our recommendation
- Inventory all Quasar projects and build servers (npm ls quasar, lockfiles, container images)
- Identify which applications run in SSR mode and whether they are reachable from the internet
- Upgrade to at least 2.23.3 and test against the newest 2.x release your team can support
- Until the upgrade, limit User-Agent header length and rate-limit SSR endpoints at the proxy
- Verify the CVSS score on NVD once analysis is complete
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Quasar security advisory GHSA-68jq-fhch-4xq4 github.com
- Quasar fix commit 7a954dd github.com
- Quasar release v2.23.3 github.com
- OSV entry CVE-2026-106104 osv.dev
- OpenCVE CVE-2026-106104 app.opencve.io
- Quasar release v2.23.3 mirror (newreleases.io) newreleases.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 05:31.
Original description (NVD)
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.23.3, Platform.parseSSR() passed an unbounded User-Agent request header to getMatch() in ui/src/plugins/platform/Platform.js, whose browser-detection expressions combined greedy captures with repeated unbounded scans. Platform belongs to autoInstalledPlugins, so this parsing occurs before routing for every SSR request. A crafted unauthenticated request containing repeated version tokens without a terminating Safari token causes super-linear backtracking and blocks the Node.js event loop, delaying every other SSR request. SPA, PWA, Electron, Cordova, Capacitor, browser-extension, and static-site-generation targets are not affected because they do not parse an attacker-controlled request header through this path. This issue is fixed in version 2.23.3.
NVD references (4)
- https://github.com/quasarframework/quasar/commit/7a954ddafa756afe95c8f633f48ed68a07209d3d
- https://github.com/quasarframework/quasar/releases/tag/quasar-v2.23.3
- https://github.com/quasarframework/quasar/security/advisories/GHSA-68jq-fhch-4xq4
- https://github.com/quasarframework/quasar/security/advisories/GHSA-68jq-fhch-4xq4
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.