Advisories for Npm/Outray package

2026

Outray has a Race Condition in the cli's webapp

This vulnerability allows a user i.e a free plan user to get more than the desired subdomains due to lack of db transaction lock mechanisms in https://github.com/akinloluwami/outray/blob/main/apps/web/src/routes/api/%24orgSlug/subdomains/index.ts

Outray cli is vulnerable to race conditions in tunnels creation

A TOCTOU race condition vulnerability allows a user to exceed the set number of active tunnels in their subscription plan.