CVE-2026-106105

Name of the Vulnerable Software and Affected Versions @quasar/ssl-certificate versions prior to 2.1.0 @quasar/cli versions prior to 5.0.4 @quasar/app-vite versions prior to 3.3.0

Description The @quasar/ssl-certificate utility caches a combined private key and certificate PEM without applying owner-only filesystem permissions. This allows a local user with read access to the cache to copy the key and impersonate a development TLS endpoint in environments that trust the certificate. Additionally, the generated certificate is CA-capable, contains overly broad key usages, and encodes the IPv6 loopback address as a DNS subject alternative name.

Recommendations Update @quasar/ssl-certificate to version 2.1.0 or later. Update @quasar/cli to version 5.0.4 or later. Update @quasar/app-vite to version 3.3.0 or later.