CVE-2026-22819: Outray has a Race Condition in main/apps/web/src/routes/api/$orgSlug/subdomains/index.ts

Severity: low (CVSS 3.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-01-14 · updated 2026-06-17
Weakness: CWE-366

Description

Outray openSource ngrok alternative. Prior to 0.1.5, this vulnerability allows a user i.e a free plan user to get more than the desired subdomains due to lack of db transaction lock mechanisms in main/apps/web/src/routes/api/$orgSlug/subdomains/index.ts. This vulnerability is fixed in 0.1.5.

Affected products

akinloluwami outray: before 0.1.5 — fixed in 0.1.5

How to fix

Upgrade to a fixed version: akinloluwami outray 0.1.5. Check the vendor advisory for mitigations.

References

https://github.com/outray-tunnel/outray/commit/73e8a09575754fb4c395438680454b2ec064d1d6
https://github.com/outray-tunnel/outray/security/advisories/GHSA-45hj-9x76-wp9g

Get alerted when CVE-2026-22819 or the next vulnerability affects your stack