Executive brief
Taylored is a Node.js backend template that manages software patch distribution and licensing through purchase tokens. A race condition in the /get-patch endpoint allows an attacker with a valid purchase token to bypass replay protection by sending two simultaneous requests, both retrieving the patch successfully. This enables license evasion, unauthorized distribution of paid content, and revenue loss.
Technical details
The vulnerability is a time-of-check-time-of-use (TOCTOU) race condition (CWE-362/CWE-367) in the /get-patch endpoint. The handler performs two separate database operations: a SELECT query to verify the purchase token is unused, followed by an UPDATE to mark it consumed. Because SQLite only provides per-statement locking, two concurrent requests can both complete the SELECT before either UPDATE executes, allowing both to bypass the replay check. An attacker with a valid purchase token can send two simultaneous requests to retrieve the patch multiple times. The fix requires replacing the read-then-write sequence with an atomic UPDATE...RETURNING statement that validates and consumes the token in a single SQLite transaction protected by write lock. Affected versions: 8.1.2 and earlier; patched in 8.1.3.
Affected products
- tailot taylored <=8.1.2
Timeline
- 2025-06-27: disclosed: Advisory GHSA-vh5j-5fhq-9xwg published
- 2025-06-27: patched: Fixed in version 8.1.3