Junglewise Threat Intelligence

CVE-2026-22819: Outray race condition in subdomain registration

CVE-2026-22819 · Severity: low · CVSS 3.1 · Published 2026-01-13

Vendors: npm.

Executive brief

Outray is a tunneling service that allows users to create subdomains based on their subscription plan. A race condition in the subdomain registration API allows attackers to bypass plan limits by sending parallel requests, enabling free plan users to create unlimited subdomains without upgrading. This bypasses the service's subscription-based monetization model and allows unauthorized access to premium features.

Technical details

The vulnerability is a classic time-of-check-time-of-use (TOCTOU) race condition in the subdomain registration endpoint. The vulnerable code queries the subscription plan, retrieves existing subdomains, validates the count against the plan limit, and then inserts a new subdomain—all without database transaction locking. An attacker can send multiple concurrent requests to the same endpoint; if request N+1 reads the subdomain table before request N's INSERT statement commits, both requests see the same old count and bypass the limit check, allowing both to succeed. The attack vector is network-based and requires valid authentication (low privilege account, e.g., free plan user). No user interaction is required. The fix involves wrapping the read-check-write sequence in a database transaction with row-level locking using `.for("update")` to serialize concurrent requests. Patches were committed on 2026-01-13; version 0.1.5 or later includes the fix.

Affected products

  • Outray Outray 0.1.3 and earlier; fixed in 0.1.5

Timeline

  • 2026-01-13: disclosed
  • 2026-01-13: patched: Fix committed on 2026-01-13; version 0.1.5 includes transaction locking

References

Related threats