Denial of Service Vulnerability in Quasar Framework Affecting Node.js Applications

CVE-2026-106104

What is CVE-2026-106104?

The Quasar Framework experienced a Denial of Service vulnerability that could affect Node.js applications prior to version 2.23.3. This issue arises when the Platform.parseSSR() function allows an unbounded User-Agent request header to be processed through getMatch() in the Platform.js file. Due to the greedy capture and unbounded scanning in the browser-detection expressions, crafted unauthenticated requests containing repeated version tokens can trigger super-linear backtracking. As a result, this can block the Node.js event loop and delay the processing of other SSR requests. It's important to note that this vulnerability does not affect SPA, PWA, Electron, Cordova, Capacitor, browser extensions, or static site generation targets since they do not process attacker-controlled request headers through this specific path. The issue has been addressed in version 2.23.3.

References