CVE-2026-22819 PUBLISHED

Outray has a Race Condition in main/apps/web/src/routes/api/$orgSlug/subdomains/index.ts

Assigner: GitHub_M
Reserved: 09.01.2026 Published: 14.01.2026 Updated: 14.01.2026

Outray openSource ngrok alternative. Prior to 0.1.5, this vulnerability allows a user i.e a free plan user to get more than the desired subdomains due to lack of db transaction lock mechanisms in main/apps/web/src/routes/api/$orgSlug/subdomains/index.ts. This vulnerability is fixed in 0.1.5.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H
CVSS Score: 5.9

Attack Vector	Network	Scope	Unchanged
Attack Complexity	High	Confidentiality Impact	None
Privileges Required	Low	Integrity Impact	Low
User Interaction	None	Availability Impact	High

CVSS 3.1

Product Status

Vendor	akinloluwami
Product	outray
Versions	Version < 0.1.5 is affected

References

https://github.com/outray-tunnel/outray/security/advisories/GHSA-45hj-9x76-wp9g
https://github.com/outray-tunnel/outray/commit/73e8a09575754fb4c395438680454b2ec064d1d6

Problem Types

CWE-366: Race Condition within a Thread CWE