5.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-22819

CVE-2026-22819: Outray has a Race Condition in main/apps/web/src/routes/api/$orgSlug/subdomains/index.ts

Outray openSource ngrok alternative. Prior to 0.1.5, this vulnerability allows a user i.e a free plan user to get more than the desired subdomains due to lack of db transaction lock mechanisms in main/apps/web/src/routes/api/$orgSlug/subdomains/index.ts. This vulnerability is fixed in 0.1.5.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-22819

CVE-2026-22819:

5.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
outray	npm	< 0.1.5	0.1.5

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic race condition in the application's API endpoints for creating subdomains and registering tunnels. The root cause is the lack of a locking mechanism when the application checks for resource limits (number of subdomains or tunnels) before creating a new resource. The application first reads the current count of resources, then compares it with the limit allowed by the user's plan, and only then proceeds to create the new resource. An attacker can exploit this by sending multiple requests in parallel. Due to the race condition, all requests might read the resource count before any of them has a chance to update it, thus all of them will pass the limit check and create a new resource, effectively bypassing the restrictions of the user's plan. The provided patches fix this by wrapping the check-and-create logic in a database transaction and using FOR UPDATE to acquire a row-level lock. This ensures that concurrent requests are serialized, preventing the race condition.

Vulnerable functions

post

apps/web/src/routes/api/$orgSlug/subdomains/index.ts

The `post` handler for creating subdomains is vulnerable to a race condition. It checks the number of existing subdomains for a user before creating a new one. This check is performed without any database-level locking. An attacker can send multiple concurrent requests to this endpoint. These requests might read the number of subdomains before any of the concurrent requests have inserted a new one, leading to a bypass of the subdomain limit defined by the user's plan.

post

apps/web/src/routes/api/tunnel/register.ts

The `post` handler for registering tunnels is vulnerable to a similar race condition as the subdomain creation. It checks the user's subscription plan and the number of active tunnels before registering a new one. This check is done without locking the relevant database rows. This allows an attacker to send parallel requests and exceed the tunnel limit for their plan.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.