npm/@quasar/ssl-certificate CVE-2026-106105: high 8.4, EPSS 0.07%

Quasar Framework: Development TLS private keys are cached with overly permissive filesystem permissions

Action: Upgrade @quasar/ssl-certificate to 2.1.0 or later.

npm i @quasar/ssl-certificate@2.1.0

Affected

Fixed versions

Sources

• osv: GHSA-fh39-c73x-5pjv
• nvd: CVE-2026-106105
• https://github.com/quasarframework/quasar/security/advisories/GHSA-fh39-c73x-5pjv
• https://github.com/quasarframework/quasar/commit/b719460aa78e88714b8a1b7ca68267234d217575
• https://github.com/quasarframework/quasar
• https://github.com/quasarframework/quasar/releases/tag/@quasar/app-vite-v3.3.0
• https://github.com/quasarframework/quasar/releases/tag/@quasar/cli-v5.0.4

CVE-2026-106105 · published 2026-10-07T16:16:18Z · modified 2026-10-07T16:30:05.797363242Z · JSON