Description
One unauthenticated request with a crafted User-Agent stalls a Quasar SSR server for seconds.
Quasar auto-installs its Platform plugin on every server-side render, and Platform.parseSSR() feeds the raw, unbounded User-Agent request header into a chain of backtracking regular expressions in getMatch().
Recommendation
Update the quasar package to the latest compatible version. Followings are version details:
- Affected version(s): <= 2.23.2
- Patched version(s): 2.23.3
References
Could your website be exposed too?
SmartScanner can check your website for Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR server and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead() - CVE-2026-106102
- Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routes - CVE-2026-119200
- xmldom: End-tag Whitespace-Trim Regex ReDoS — quadratic backtracking in the 0.8.x end-tag parser - CVE-2026-83619
- pdfmake is vulnerable to server-side request forgery (SSRF) - CVE-2026-26801
You might also like:
See something that needs correcting? Let us knowUpdated October 07, 2026