Server-Side Rendering Vulnerability in Quasar Framework by Quasar

CVE-2026-106106

What is CVE-2026-106106?

The Quasar Framework, used for developing high-performance Vue.js interfaces, contains a vulnerability in its server-side rendering mechanism. Before versions 2.2.4 and 3.3.0, the function renderSSRError() in utils/render-ssr-error/src/index.js exposed sensitive diagnostic data from environment variables, request headers, and cookies via the HTTP page returned by serve.devError(). This security flaw allows network-adjacent clients to potentially access environment secrets during SSR or SSG render failures—particularly in a development environment where the server listens on all interfaces. Additionally, the issue includes a possibility for markup injection due to improper script closing-tag handling in the reflected diagnostic data. This flaw has been addressed in the updated versions of the framework.

References