A super‑linear regular expression in Quasar Framework’s Server‑Side Rendering logic parses the User‑Agent header in an unbounded way. A crafted header that repeats version indicators without a terminating Safari token forces the regex engine to perform an exponential‑time backtracking operation, blocking the Node.js event loop. As a result, every SSR request is stalled until the backtracking completes, effectively denying service to all users of the affected application.

All installations of quasarframework:quasar prior to version 2.23.3 that expose a Server‑Side Rendering endpoint are vulnerable. The flaw resides in Platform.parseSSR(), which is automatically invoked for every SSR request. Single‑page applications, progress web apps, Electron, Cordova, Capacitor, browser extensions, and static‑site‑generation builds are not affected because they do not process the User‑Agent header through this path.

The CVSS score of 8.7 marks this as a high‑severity issue. EPSS data is not available, and the vulnerability is not listed in CISA KEV catalog. The flaw is exploitable over the network with no authentication required; an attacker only needs to send a single malformed User‑Agent header to an SSR URL. Once triggered, the server’s event loop is stalled, preventing any other SSR requests from completing and causing widespread denial of service until the event loop recovers.