fkie_cve-2026-106104

2026-10-08T06:57:46.173826+00:00

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.23.3, Platform.parseSSR() passed an unbounded User-Agent request header to getMatch() in ui/src/plugins/platform/Platform.js, whose browser-detection expressions combined greedy captures with repeated unbounded scans. Platform belongs to autoInstalledPlugins, so this parsing occurs before routing for every SSR request. A crafted unauthenticated request containing repeated version tokens without a terminating Safari token causes super-linear backtracking and blocks the Node.js event loop, delaying every other SSR request. SPA, PWA, Electron, Cordova, Capacitor, browser-extension, and static-site-generation targets are not affected because they do not parse an attacker-controlled request header through this path. This issue is fixed in version 2.23.3.

GHSA-68jq-fhch-4xq4 — Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR server

2026-10-08T06:57:46.173935+00:00

Affected: npm: quasar

### Summary

One unauthenticated request with a crafted `User-Agent` stalls a Quasar SSR server for seconds.

Quasar auto-installs its `Platform` plugin on every server-side render, and `Platform.parseSSR()` feeds the raw, unbounded `User-Agent` request header into a chain of backtracking regular expressions in `getMatch()`. One of those patterns contains a greedy capture followed by two unbounded `.*` scans, so a crafted header costs time proportional to the cube of its length. An 8 KB `User-Agent` blocks the Node.js event loop for about 4.4 seconds, and a 16 KB one for about 35 seconds. During that time the server answers nobody, so a handful of tiny requests take an SSR site completely offline.

### Details

`Platform` is in the `autoInstalledPlugins` array in `ui/src/install-quasar.js`, so it is installed unconditionally by `app.use(Quasar, ...)`. The generated SSR entry (`app-vite/templates/entry/app.js`, called from `app-vite/templates/entry/server-entry.js`) runs that for every HTTP request, and it runs before routing, so requests to paths that do not exist are affected too. On the server the plugin takes the header verbatim (`ui/src/plugins/platform/Platform.js`):

```js Platform.parseSSR = ssrContext => { const ua = ssrContext.req.headers['user-agent'] || ssrContext.req.headers['User-Agent'] || ''

return { ...client, userAgent: ua, is: getPlatform(ua) } } ```

`getPlatform()` lowercases the string and passes it to `getMatch()` (`ui/src/plugins/platf…

Most recent entries from all

fkie_cve-2026-106104

GHSA-68jq-fhch-4xq4 — Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR server