CVE-2026-106107: Quasar Framework: App Vite SSR and SSG nonce attributes are not safely constrained

Q: Which deployments are exposed?

Applications using @quasar/app-vite versions earlier than 3.3.0 are exposed only if their SSR or SSG nonce value is derived from, or overridden by, attacker-controlled data. The affected rendering paths exist in both development and production SSR or SSG output.

Q: What should be done if an immediate upgrade is not possible?

Ensure that ssrContext.nonce cannot be derived from or overridden with untrusted input, and restrict it to cryptographically generated base64 or base64url values. Upgrade @quasar/app-vite to version 3.3.0 when possible.

Q: How can teams identify whether they are affected?

Check whether the application uses @quasar/app-vite earlier than 3.3.0 and review all code that sets or influences ssrContext.nonce. Also inspect generated SSR and SSG HTML for nonce attributes containing values sourced from request data or other untrusted inputs.

Published Oct 6, 2026

Updated

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 3.3.0, several @quasar/app-vite SSR and SSG rendering paths interpolated ssrContext.nonce directly into quoted HTML attributes. An application that derives or overrides this value with attacker-controlled data can allow a quote to terminate the nonce attribute and inject additional attributes or markup into generated HTML across development and production SSR or SSG output. Cryptographically generated base64 or base64url nonces are not affected because they lack HTML attribute delimiters. This issue is fixed in version 3.3.0.

Affected Software

1 affected component

npm/@quasar/app-vite<3.3.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade @quasar/app-vite to a version that resolves this vulnerability.
Fixed in 3.3.0

Event History

Oct 6, 2026

CVE Published

via MITRE·05:26 PM

Data Sourced

via MITRE·05:26 PM

DescriptionWeakness

Data Sourced

via NVD·06:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

Applications using @quasar/app-vite versions earlier than 3.3.0 are exposed only if their SSR or SSG nonce value is derived from, or overridden by, attacker-controlled data. The affected rendering paths exist in both development and production SSR or SSG output.

Are applications using normal cryptographic nonces affected?

Cryptographically generated base64 or base64url nonces are not affected, because those encodings do not contain HTML attribute delimiters. Risk arises when the nonce value can contain attacker-supplied quote characters or similar attribute-breaking content.

What should be done if an immediate upgrade is not possible?

Ensure that ssrContext.nonce cannot be derived from or overridden with untrusted input, and restrict it to cryptographically generated base64 or base64url values. Upgrade @quasar/app-vite to version 3.3.0 when possible.

How can teams identify whether they are affected?

Check whether the application uses @quasar/app-vite earlier than 3.3.0 and review all code that sets or influences ssrContext.nonce. Also inspect generated SSR and SSG HTML for nonce attributes containing values sourced from request data or other untrusted inputs.

CVE-2026-106107: Quasar Framework: App Vite SSR and SSG nonce attributes are not safely constrained

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed?

Are applications using normal cryptographic nonces affected?

What should be done if an immediate upgrade is not possible?

How can teams identify whether they are affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

Are applications using normal cryptographic nonces affected?

What should be done if an immediate upgrade is not possible?

How can teams identify whether they are affected?