# CVE-2026-106105: Quasar Framework SSL certificate cache permissions vulnerability

Source: https://junglewise.ai/threats/cve-2026-106105-quasar-framework-is-a-framework-for-building-high-performance  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-06. Updated: 2026-10-06  
License: CC BY 4.0 with a link back

CVE-2026-106105 · Severity: high · CVSS 4 · Published 2026-10-06

Quasar Framework is a tool for building Vue.js web applications that developers use during local development. The framework cached development TLS certificates and private keys with world-readable permissions, allowing other local users to copy them and impersonate development servers. An attacker with local access could steal credentials and perform man-in-the-middle attacks against development environments that trust the certificate.

Technologies: [@quasar/app-vite (npm)](https://junglewise.ai/threats/technologies/npm-quasar-app-vite), [Quasar @Quasar/App-Vite](https://junglewise.ai/threats/technologies/quasar-app-vite). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [Quasar](https://junglewise.ai/threats/vendors/quasar).

## Quick answers

**Is CVE-2026-106105 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-106105 being exploited in the wild.

**How severe is CVE-2026-106105?** High severity, with a CVSS score of 4, published 6 October 2026.

**Which products and versions are affected?** @quasar/app-vite (npm) <= 3.2.0, SEMVER:introduced=0,fixed=3.3.0; @quasar/cli (npm) <= 5.0.3, SEMVER:introduced=0,fixed=5.0.4; @quasar/ssl-certificate (npm) <= 2.0.0, SEMVER:introduced=0,fixed=2.1.0; Quasar @Quasar/App-Vite prior to 3.3.0; and 2 more.

**Is there a fix for CVE-2026-106105?** Yes. @quasar/app-vite (npm): upgrade to 3.3.0 or later; @quasar/cli (npm): upgrade to 5.0.4 or later; @quasar/ssl-certificate (npm): upgrade to 2.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-106105 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-106105?** Check whether you run @quasar/app-vite (npm), @quasar/cli (npm), @quasar/ssl-certificate (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @quasar/app-vite (npm): upgrade to 3.3.0 or later

  ```sh
  npm install @quasar/app-vite@3.3.0
  ```

- @quasar/cli (npm): upgrade to 5.0.4 or later

  ```sh
  npm install @quasar/cli@5.0.4
  ```

- @quasar/ssl-certificate (npm): upgrade to 2.1.0 or later

  ```sh
  npm install @quasar/ssl-certificate@2.1.0
  ```


## Technical details

The @quasar/ssl-certificate utility cached a combined private key and certificate in PEM format without setting owner-only filesystem permissions (mode 0600), allowing local users to read the material via the cache directory. The generated certificate was also CA-capable with overly broad key usages and included the IPv6 loopback address as a DNS SAN. An attacker with local system access can read the cache, extract the private key, and impersonate the development TLS endpoint in environments trusting that certificate.

## Affected products

- Quasar @quasar/ssl-certificate prior to 2.1.0
- Quasar @quasar/cli prior to 5.0.4
- Quasar @quasar/app-vite prior to 3.3.0

## Identifiers

- CVE-2026-106105
- GHSA-fh39-c73x-5pjv

## Timeline

- 2026-07-29: patched: Fixes released in @quasar/ssl-certificate 2.1.0, @quasar/cli 5.0.4, and @quasar/app-vite 3.3.0
- 2026-10-06: disclosed

## References

- [https://github.com/quasarframework/quasar/commit/b719460aa78e88714b8a1b7ca68267234d217575](https://github.com/quasarframework/quasar/commit/b719460aa78e88714b8a1b7ca68267234d217575)
- [https://github.com/quasarframework/quasar/releases/tag/@quasar/app-vite-v3.3.0](https://github.com/quasarframework/quasar/releases/tag/@quasar/app-vite-v3.3.0)

## Related threats

- [Quasar Framework App Vite SSG path traversal in output directory](https://junglewise.ai/threats/cve-2026-106108-quasar-framework-app-vite-ssg-page-output-paths-can-escape-the)
- [Quasar Framework @quasar/app-vite unsafe build directory cleanup](https://junglewise.ai/threats/cve-2026-106109-quasar-framework-is-a-framework-for-building-high-performance)
- [Quasar Framework SSR/SSG nonce injection in HTML attributes](https://junglewise.ai/threats/cve-2026-106107-quasar-framework-is-a-framework-for-building-high-performance)
- [Quasar Framework SSR/SSG information disclosure in development server](https://junglewise.ai/threats/cve-2026-106106-quasar-framework-is-a-framework-for-building-high-performance)