p PatchFirst

PatchFirst · Latest vulnerabilities

@quasar/render-ssr-error vulnerabilities

Vulnerability published for @quasar/render-ssr-error in the last 30 days: 1. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerability: 1

  1. CVE-2026-106106

    High · CVSS 7.1EPSS 0.28%Fix available

    Quasar Framework: SSR/SSG dev error page discloses the full shell environment and its </script> escape is bypassable

    Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/render-ssr-error 2.2.4 and @quasar/app-vite 3.3.0, renderSSRError() in utils/render-ssr-error/src/index.js used diagnostic data from utils/render-ssr-error/src/env.js to serialize process.env, request headers, and cookies into the HTTP page returned by serve.devError(), while the development server listened on all interfaces by default. Any network-adjacent client that reaches an SSR or SSG render failure through this development-only error path can obtain shell environment secrets. The renderer escaped only one exact lowercase script closin

    @quasar/render-ssr-errorNode.js
    • Update to 2.2.4
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →