CVE-2026-22819
Medium · 5.9Outray has a Race Condition in the cli's webapp
CVSS
5.9
EPSS
0.2%
Published
Jan 13, 2026
CISA due date
—
The record
This vulnerability allows a user i.e a free plan user to get more than the desired subdomains due to lack of db transaction lock mechanisms in `https://github.com/akinloluwami/outray/blob/main/apps/web/src/routes/api/%24orgSlug/subdomains/index.ts`
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | outray | 0 | 0.1.5 |
Related vulnerabilities
- GHSA-45hj-9x76-wp9g Outray has a Race Condition in the cli's webapp Same vulnerability
- GHSA-3pqc-836w-jgr7 Outray cli is vulnerable to race conditions in tunnels creation Also affects outray
- CVE-2026-22820 Outray cli is vulnerable to race conditions in tunnels creation Also affects outray
- CVE-2026-3904 Calling NSS-backed functions that support caching via nscd may call the nscd client side… CWE-366
- CVE-2026-23684 A race condition vulnerability exists in the SAP Commerce cloud. CWE-366
- CVE-2023-6546 A race condition was found in the GSM 0710 tty multiplexor in the Linux kernel. CWE-366
- CVE-2026-38739 ezsystems/ezpublish-legacy has a SQL injection in dfscleanup CWE-937
- CVE-2026-47121 Sparkle: Binary delta apply intermediate-symlink traversal in malicious .delta CWE-937