Is CVE-2026-106106 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-106106 being exploited in the wild.

How severe is CVE-2026-106106?

High severity, with a CVSS score of 4, published 6 October 2026.

Which products and versions are affected?

@quasar/app-vite (npm) <= 3.2.0, SEMVER:introduced=0,fixed=3.3.0; @quasar/render-ssr-error (npm) <= 2.2.3, SEMVER:introduced=0,fixed=2.2.4; Quasar @Quasar/App-Vite prior to 3.3.0; Quasar @Quasar/Render-Ssr-Error prior to 2.2.4.

Is there a fix for CVE-2026-106106?

Yes. @quasar/app-vite (npm): upgrade to 3.3.0 or later; @quasar/render-ssr-error (npm): upgrade to 2.2.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-106106 attacked?

It is attacked over the network or from the adjacent network, in a software library.

Am I affected by CVE-2026-106106?

Check whether you run @quasar/app-vite (npm), @quasar/render-ssr-error (npm), Quasar @Quasar/App-Vite or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-106106: Quasar Framework SSR/SSG information disclosure in development server

Q: Is there a fix for CVE-2026-106106?

Yes. @quasar/app-vite (npm): upgrade to 3.3.0 or later; @quasar/render-ssr-error (npm): upgrade to 2.2.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-106106 attacked?

It is attacked over the network or from the adjacent network, in a software library.

Q: Am I affected by CVE-2026-106106?

Check whether you run @quasar/app-vite (npm), @quasar/render-ssr-error (npm), Quasar @Quasar/App-Vite or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-106106 · Severity: high · CVSS 4 · Published 2026-10-06

Quasar Framework is a Vue.js development platform that includes a built-in development server. During server-side rendering (SSR) or static site generation (SSG) errors, the development server exposed sensitive environment variables, request headers, and cookies in error pages. Additionally, a markup injection flaw allowed attackers on the same network to inject code that executes in a developer's browser, potentially leading to account takeover or data theft.

Technologies: @quasar/app-vite (npm), Quasar @Quasar/App-Vite. Vendors: npm, Quasar.

Quick answers

Is CVE-2026-106106 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-106106 being exploited in the wild.
How severe is CVE-2026-106106?: High severity, with a CVSS score of 4, published 6 October 2026.
Which products and versions are affected?: @quasar/app-vite (npm) <= 3.2.0, SEMVER:introduced=0,fixed=3.3.0; @quasar/render-ssr-error (npm) <= 2.2.3, SEMVER:introduced=0,fixed=2.2.4; Quasar @Quasar/App-Vite prior to 3.3.0; Quasar @Quasar/Render-Ssr-Error prior to 2.2.4.
Is there a fix for CVE-2026-106106?: Yes. @quasar/app-vite (npm): upgrade to 3.3.0 or later; @quasar/render-ssr-error (npm): upgrade to 2.2.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-106106 attacked?: It is attacked over the network or from the adjacent network, in a software library.
Am I affected by CVE-2026-106106?: Check whether you run @quasar/app-vite (npm), @quasar/render-ssr-error (npm), Quasar @Quasar/App-Vite or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@quasar/app-vite (npm): upgrade to 3.3.0 or later
```
npm install @quasar/app-vite@3.3.0
```
@quasar/render-ssr-error (npm): upgrade to 2.2.4 or later
```
npm install @quasar/render-ssr-error@2.2.4
```

Technical details

The renderSSRError() function in @quasar/render-ssr-error serialized process.env, request headers, and cookies into HTTP error responses without proper protection, and the development server listened on all interfaces by default. A case-sensitive script tag filter allowed attackers to inject arbitrary markup via case variants and delimiter mutations in diagnostic data. Exploitation requires network adjacency to reach the dev server and the victim developer's browser to visit a malicious link, but no authentication is needed.

Affected products

Quasar @quasar/render-ssr-error prior to 2.2.4
Quasar @quasar/app-vite prior to 3.3.0

Identifiers

CVE-2026-106106
GHSA-r5mf-4r5x-q78f

Timeline

2026-10-06: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.