CVE-2026-22819 Outray has a Race Condition in main/apps/web/src/routes/api/$orgSlug/subdomains/index.ts
A race condition in Outray allows free-tier users to bypass subdomain limits by exploiting missing database transaction locks.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-22819?
CVE-2026-22819 is a medium-severity vulnerability in akinloluwami outray, published on 14 Jan 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Outray openSource ngrok alternative. Prior to 0.1.5, this vulnerability allows a user i.e a free plan user to get more than the desired subdomains due to lack of db transaction lock mechanisms in main/apps/web/src/routes/api/$orgSlug/subdomains/index.ts. This vulnerability is fixed in 0.1.5.
Weakness: CWE-366
Which versions are affected by CVE-2026-22819?
2 open source packages ship an affected version, including outray. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
outray npm | All versions | 0.1.5 |
outray npm | All versions | 0.1.5 |
Products include Outray Outray.
How do I fix CVE-2026-22819?
Upgrade outray to 0.1.5 or later.
Is CVE-2026-22819 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-22819 exists.
Other vulnerabilities in akinloluwami outray
Sources
Also known as GHSA-45hj-9x76-wp9g.