{"id":"EUVD-2026-93569","enisaUuid":"37ccd000-4bc6-347b-8618-99979e5afb81","description":"Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.23.3, Platform.parseSSR() passed an unbounded User-Agent request header to getMatch() in ui/src/plugins/platform/Platform.js, whose browser-detection expressions combined greedy captures with repeated unbounded scans. Platform belongs to autoInstalledPlugins, so this parsing occurs before routing for every SSR request. A crafted unauthenticated request containing repeated version tokens without a terminating Safari token causes super-linear backtracking and blocks the Node.js event loop, delaying every other SSR request. SPA, PWA, Electron, Cordova, Capacitor, browser-extension, and static-site-generation targets are not affected because they do not parse an attacker-controlled request header through this path. This issue is fixed in version 2.23.3.","datePublished":"Oct 6, 2026, 5:14:45 PM","dateUpdated":"Oct 9, 2026, 1:18:50 AM","baseScore":8.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/quasarframework/quasar/security/advisories/GHSA-68jq-fhch-4xq4\nhttps://github.com/quasarframework/quasar/commit/7a954ddafa756afe95c8f633f48ed68a07209d3d\nhttps://github.com/quasarframework/quasar/releases/tag/quasar-v2.23.3\n","aliases":"CVE-2026-106104\nGHSA-68jq-fhch-4xq4\n","assigner":"GitHub_M","epss":0.37,"enisaIdProduct":[{"id":"b2970f13-e063-3d78-a44e-54251de0345b","product":{"name":"quasar","vendor":{"name":"quasarframework"}},"product_version":"\u003c 2.23.3"}],"enisaIdVendor":[{"id":"f4c62bae-e323-3a27-9995-d53170c9e8f3","vendor":{"name":"quasarframework"}}],"enisaIdVulnerability":[{"id":"1e01bdb5-07bc-38a5-b0f6-9ef2c439fe51","vulnerability":{"id":"GHSA-68jq-fhch-4xq4","description":"Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR server","datePublished":"Oct 7, 2026, 4:14:31 PM","dateUpdated":"Oct 7, 2026, 4:14:31 PM","baseScore":0.0,"references":"https://github.com/quasarframework/quasar/security/advisories/GHSA-68jq-fhch-4xq4\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-106104\nhttps://github.com/quasarframework/quasar/commit/7a954ddafa756afe95c8f633f48ed68a07209d3d\nhttps://github.com/quasarframework/quasar\nhttps://github.com/quasarframework/quasar/releases/tag/quasar-v2.23.3\n","enisa_id":"EUVD-2026-93569\n","aliases":"GHSA-68jq-fhch-4xq4\nCVE-2026-106104\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:07:07 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"4acd3655-78bd-3315-aa31-c01bad12d4de","vulnerability":{"id":"CVE-2026-106104","description":"Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.23.3, Platform.parseSSR() passed an unbounded User-Agent request header to getMatch() in ui/src/plugins/platform/Platform.js, whose browser-detection expressions combined greedy captures with repeated unbounded scans. Platform belongs to autoInstalledPlugins, so this parsing occurs before routing for every SSR request. A crafted unauthenticated request containing repeated version tokens without a terminating Safari token causes super-linear backtracking and blocks the Node.js event loop, delaying every other SSR request. SPA, PWA, Electron, Cordova, Capacitor, browser-extension, and static-site-generation targets are not affected because they do not parse an attacker-controlled request header through this path. This issue is fixed in version 2.23.3.","datePublished":"Oct 6, 2026, 5:14:45 PM","dateUpdated":"Oct 9, 2026, 1:18:50 AM","status":"PUBLISHED","baseScore":8.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/quasarframework/quasar/security/advisories/GHSA-68jq-fhch-4xq4\nhttps://github.com/quasarframework/quasar/commit/7a954ddafa756afe95c8f633f48ed68a07209d3d\nhttps://github.com/quasarframework/quasar/releases/tag/quasar-v2.23.3\n","enisa_id":"EUVD-2026-93569\n","assigner":"GitHub_M","epss":0.37,"dataProcessed":"Nov 1, 2026, 4:04:34 AM","vulnerabilityProduct":[{"id":"f2354a93-7c9a-370a-b59d-3ab967e23552","product":{"name":"quasar","vendor":{"name":"quasarframework"}},"product_version":"\u003c 2.23.3"}],"vulnerabilityVendor":[{"id":"12e414f8-a46c-34c7-8cc9-ce1a2bdf5c11","vendor":{"name":"quasarframework"}}]}}],"enisaIdAdvisory":[]}