CVE-2026-22820: 
JavaScript vulnerability analysis and mitigation

CVE-2026-22820 is a Time-of-check Time-of-use (TOCTOU) race condition vulnerability in the Outray CLI tunnel registration component that allows users to bypass subscription-enforced tunnel limits and consume server resources without incurring billing charges. It affects the outray npm package versions prior to 0.1.5, specifically version 0.1.3 and earlier. The vulnerability was published on January 13, 2026, with a patch released on January 20, 2026. It carries a CVSS v3.1 base score of 3.7 (Low) and a CVSS v4.0 base score of 6.3 (Medium) (Github Advisory, Outray Advisory).

The root cause is a CWE-367 (TOCTOU Race Condition) in the /tunnel/register API endpoint (apps/web/src/routes/api/tunnel/register.ts). The vulnerable code checks the active tunnel count in Redis and the database to enforce subscription plan limits, but performs the database insert (await db.insert(tunnels).values(tunnelRecord)) outside of a locked transaction — meaning concurrent requests can each pass the limit check before any of them commits the new tunnel record. By triggering multiple simultaneous tunnel registration requests (e.g., via the WSHandler in the CLI), an attacker can race past the limit check and register more tunnels than their plan permits. The fix wraps the subscription check, tunnel existence check, and insert into a single database transaction with row-level locking (.for("update")) to serialize concurrent requests (Github Advisory, Patch Commit).

Successful exploitation allows an authenticated user to exceed their subscription plan's tunnel limit, consuming server-side resources (tunnels, bandwidth, compute) without paying for them — effectively constituting cost theft against the service operator. There is no confidentiality impact (no data exposure), and the integrity impact is limited to unauthorized modification of resource usage state. Availability may be degraded for legitimate users if server resources are exhausted by abusive tunnel creation (Github Advisory, Outray Advisory).

A public proof-of-concept (PoC) bash script is included in the security advisory, demonstrating the race condition by launching multiple outray CLI instances simultaneously using tmux to open more tunnels than the plan allows. As of the time of disclosure, there is no evidence of active in-the-wild exploitation. The EPSS score is approximately 0.038–0.055% (18th percentile), indicating low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported (Github Advisory, Outray Advisory).

1. Obtain a valid Outray account: Register for any subscription plan (including free tier) on an Outray instance running a vulnerable version (< 0.1.5).
2. Install the vulnerable CLI: Run npm install -g outray to install a version prior to 0.1.5.
3. Prepare the race condition script: Create a bash script that launches multiple outray CLI instances simultaneously targeting different local ports (e.g., 8090, 4000, 5000, 6000) using tmux split panes.
4. Execute concurrent tunnel registrations: Run the script (bash kay.sh) to start all outray instances at nearly the same time. Each instance sends a registration request to the /tunnel/register endpoint concurrently.
5. Race past the limit check: Because the server checks the active tunnel count before inserting the new record — without transaction locking — multiple requests pass the limit check simultaneously before any insert is committed, allowing more tunnels than the plan permits to be registered.
6. Confirm bypass: Attach to the tmux session (tmux attach -t outray-race) and observe that all tunnels are active, exceeding the subscription limit without triggering a 403 error (Github Advisory, Outray Advisory).

• Logs: Server-side logs showing multiple near-simultaneous [TUNNEL LIMIT CHECK] ALLOWED entries for the same organizationId within milliseconds of each other, followed by more tunnel records than the plan limit in the database.
• Database: Tunnel count for an organization in the tunnels table exceeding the plan's maxTunnels limit as defined by getPlanLimits().
• Network: Burst of concurrent HTTP POST requests to the /api/tunnel/register endpoint from the same user/organization in a very short time window.
• Redis: The org:<organizationId>:online_tunnels Redis SET containing more members than the subscription plan allows (Github Advisory).

Upgrade the outray npm package to version 0.1.5 or later, which wraps the subscription check, tunnel existence check, and insert into a single database transaction with row-level locking (.for("update")) to prevent concurrent requests from bypassing the limit. No configuration-based workaround is available for the vulnerable versions; upgrading is the only effective remediation. Operators should also audit their database for organizations with tunnel counts exceeding their plan limits and review server resource usage for signs of prior abuse (Patch Commit, Github Advisory).

The vulnerability was reported by researcher gr33pp and analyzed by SENSEiXENUS, with the advisory published by xt42io on January 13, 2026. The issue received standard coverage from automated vulnerability tracking services (Vulners, CVEFeed, VulDB, INCIBE) and was noted in a CISA weekly vulnerability summary for the week of January 12, 2026. No significant independent researcher commentary or broader media coverage has been identified beyond routine aggregation (Outray Advisory).