EUVD-2026-93569
GHSA-68jq-fhch-4xq4
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote unauthenticated single-request ReDoS with low complexity (AV:N/AC:L/PR:N/UI:N); only availability is impacted (A:H), and the stalled event loop stays within the same component (S:U).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
6DescriptionCVE.org
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.23.3, Platform.parseSSR() passed an unbounded User-Agent request header to getMatch() in ui/src/plugins/platform/Platform.js, whose browser-detection expressions combined greedy captures with repeated unbounded scans. Platform belongs to autoInstalledPlugins, so this parsing occurs before routing for every SSR request. A crafted unauthenticated request containing repeated version tokens without a terminating Safari token causes super-linear backtracking and blocks the Node.js event loop, delaying every other SSR request. SPA, PWA, Electron, Cordova, Capacitor, browser-extension, and static-site-generation targets are not affected because they do not parse an attacker-controlled request header through this path. This issue is fixed in version 2.23.3.
Articles & Coverage 1
AnalysisAI
Unauthenticated remote attackers can stall server-side rendering in Quasar Framework versions prior to 2.23.3 by sending a crafted User-Agent header that triggers catastrophic regex backtracking in Platform.parseSSR(). Because Platform is an auto-installed plugin, the header is parsed before routing on every SSR request, so a single malformed request keeps the Node.js event loop busy and delays or blocks all other SSR traffic - an availability-only impact (CVSS 4.0 base 8.7; our assessment CVSS 3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitable ONLY when the Quasar application is built and deployed in SSR (server-side rendering) mode, where Platform (an autoInstalledPlugin) calls Platform.parseSSR() and feeds the unbounded, attacker-controlled User-Agent request header into getMatch() before routing. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine availability risk for a specific deployment mode, not an inflated high-CVSS issue, but its blast radius is narrower than the 8.7 headline suggests. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Quasar Framework 2.23.3 or later - the vendor-released patch - as documented in the release notes at https://github.com/quasarframework/quasar/releases/tag/quasar-v2.23.3 and the advisory at https://github.com/quasarframework/quasar/security/advisories/GHSA-68jq-fhch-4xq4. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Quasar Framework SSR deployments and confirm versions; if running versions prior to 2.23.3, immediately disable SSR if not business-critical or deploy WAF rules to block crafted User-Agent headers and enable rate limiting. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today