CVE-2026-22819: 
JavaScript vulnerability analysis and mitigation

CVE-2026-22819 is a race condition vulnerability in Outray, an open-source ngrok alternative, affecting the subdomain management API endpoint (main/apps/web/src/routes/api/$orgSlug/subdomains/index.ts). It allows authenticated free-plan users to bypass subdomain quota restrictions by exploiting the absence of database transaction locking mechanisms. All versions prior to 0.1.5 are affected. The vulnerability was published on January 13, 2026, and patched in version 0.1.5. The GitHub Advisory Database rates it as Moderate with a CVSS v3.1 score of 5.9 (the Feedly data notes a base score of 3.1 under a different vector; the advisory-published score is 5.9) (Github Advisory).

The root cause is CWE-366 (Race Condition within a Thread): the subdomain creation handler in index.ts performs a read-check-insert sequence across three separate, unlocked database queries without wrapping them in a transaction with row-level locking. An attacker can send multiple parallel HTTP requests to the subdomain creation endpoint; because each concurrent request reads the existing subdomain count before any of the parallel inserts have committed, all requests observe a count below the plan limit and proceed to insert, effectively bypassing the quota check. The vulnerable pattern is: (1) read subscription plan, (2) count existing subdomains (no lock), (3) check against limit, (4) insert new subdomain — steps 2–4 are not atomic. The fix (commits 73e8a09 and 08c6149) wraps these operations in a database transaction with .for("update") row-level locking to serialize concurrent requests (Github Advisory, Patch Commit).

Successful exploitation allows authenticated free-plan users to obtain an unlimited number of subdomains without a paid subscription, bypassing the platform's business model enforcement. There is no confidentiality impact, but integrity is affected as unauthorized subdomains are created in the database, and availability may be degraded through resource exhaustion as platform subdomain capacity is consumed by malicious actors. The impact is limited to the Outray platform itself and does not enable lateral movement or data exfiltration (Github Advisory).

A proof-of-concept exploit is publicly documented in the GitHub security advisory, demonstrating the use of Burp Suite's Repeater to send batched parallel requests to the subdomain creation endpoint. There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.036–0.044% (14th percentile), indicating low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (Github Advisory).

1. Authenticate: Obtain a valid session token for a free-plan Outray account.
2. Identify the endpoint: Target the subdomain creation API at /api/$orgSlug/subdomains/ on the Outray web application.
3. Intercept a request: Use Burp Suite to intercept a legitimate subdomain creation POST request and send it to the Repeater module.
4. Create parallel requests: Duplicate the request multiple times in Burp Repeater, each with a different subdomain name in the request body.
5. Send in parallel: Use Burp's "Send group in parallel" feature to dispatch all requests simultaneously, exploiting the race window between the database read (subdomain count check) and the subsequent insert.
6. Verify bypass: Observe that multiple subdomains are successfully created despite the free-plan limit, as each parallel request read the pre-insert subdomain count and passed the quota check before any insert committed (Github Advisory).

• Network: Burst of simultaneous POST requests to /api/<orgSlug>/subdomains/ from the same authenticated session within a very short time window (milliseconds apart).
• Logs: Application logs showing multiple successful subdomain creation responses (HTTP 200/201) for the same organization in rapid succession, exceeding the plan's configured limit.
• Database: Subdomain table entries for a single organization exceeding the plan's maxSubdomains limit; timestamps of multiple subdomain rows clustered within the same second.

Upgrade Outray to version 0.1.5 or later, which wraps subdomain creation in a database transaction with row-level locking (.for("update")) to serialize concurrent requests. For environments where immediate patching is not possible, implement rate limiting and request throttling on the subdomain creation API endpoint to reduce the feasibility of parallel request exploitation. The fix is available in commits 73e8a09 (subdomains) and 08c6149 (tunnel registration) (Github Advisory, Patch Commit, Patch Commit 2).