# CVE-2026-106104: Quasar Framework ReDoS in SSR User-Agent parsing

Source: https://junglewise.ai/threats/cve-2026-106104-quasar-framework-is-a-framework-for-building-high-performance  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-06. Updated: 2026-10-06  
License: CC BY 4.0 with a link back

CVE-2026-106104 · Severity: high · CVSS 4 · Published 2026-10-06

Quasar Framework is a Vue.js UI framework that powers modern web applications. In server-side rendering (SSR) mode, a crafted HTTP request with a specially malformed User-Agent header can cause the framework to hang and block the Node.js server, making it unresponsive to legitimate requests and causing denial of service.

Technologies: [quasar (npm)](https://junglewise.ai/threats/technologies/quasar). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-106104 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-106104 being exploited in the wild.

**How severe is CVE-2026-106104?** High severity, with a CVSS score of 4, published 6 October 2026.

**Which products and versions are affected?** quasar (npm) <= 2.23.2, SEMVER:introduced=0,fixed=2.23.3; Quasar Framework Quasar before 2.23.3.

**Is there a fix for CVE-2026-106104?** Yes. quasar (npm): upgrade to 2.23.3 or later. Until then: Disable SSR mode or restrict access to SSR endpoints until upgrading, as SPA, PWA, Electron, Cordova, Capacitor, browser-extension, and static-site-generation targets are not affected by this vulnerability. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-106104 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-106104?** Check whether you run quasar (npm) or Quasar Framework Quasar at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- quasar (npm): upgrade to 2.23.3 or later

  ```sh
  npm install quasar@2.23.3
  ```


Disable SSR mode or restrict access to SSR endpoints until upgrading, as SPA, PWA, Electron, Cordova, Capacitor, browser-extension, and static-site-generation targets are not affected by this vulnerability.

## Technical details

The vulnerability is a Regular Expression Denial of Service (ReDoS) in the Platform.parseSSR() function, which processes the User-Agent header through browser-detection regex expressions containing greedy captures and unbounded scans. An attacker sends an unauthenticated request with repeated version tokens without termination, triggering super-linear backtracking that blocks the event loop. The fix introduces a 512-byte length limit on User-Agent parsing and removes greedy quantifiers from browser-detection patterns.

## Affected products

- Quasar Framework Quasar before 2.23.3

## Identifiers

- CVE-2026-106104
- GHSA-68jq-fhch-4xq4

## Timeline

- 2026-07-28: patched: Fix released in version 2.23.3
- 2026-10-06: disclosed

## References

- [https://github.com/quasarframework/quasar/commit/7a954ddafa756afe95c8f633f48ed68a07209d3d](https://github.com/quasarframework/quasar/commit/7a954ddafa756afe95c8f633f48ed68a07209d3d)
- [https://github.com/quasarframework/quasar/releases/tag/quasar-v2.23.3](https://github.com/quasarframework/quasar/releases/tag/quasar-v2.23.3)

## Related threats

- [Quasar Framework SSR meta serialization XSS](https://junglewise.ai/threats/cve-2026-106102-quasar-framework-is-a-framework-for-building-high-performance)
- [Quasar Framework: DOM Clobbering in Quasar openURL() SafariViewController Integration Causes Client-Side Denial of Service](https://junglewise.ai/threats/cve-2026-106101-quasar-framework-is-a-framework-for-building-high-performance)
- [Quasar extend() utility prototype pollution](https://junglewise.ai/threats/cve-2026-73647-quasar-extend-utility-prototype-pollution)