GCVE - cpe:2.3:a:outray:outray:*:*:*:*:*:node.js:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:outray:outray:*:*:*:*:*:node.js:*:*

part: a version: * update: *

Notes

Imported from gcve-enriched-dumps CVE data

PURL	Source	Last updated
`pkg:github/outray-tunnel/outray`	purl2cpe	2026-07-28 16:40:55.216190

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-22820`	vulnerable	2026-06-08 07:51:13.998599	Outray cli is vulnerable to race conditions in tunnels creation Outray openSource ngrok alternative. Prior to 0.1.5, a TOCTOU race condition vulnerability allows a user to exceed the set number of active tunnels in their subscription plan. This vulnerability is fixed in 0.1.5. Published: 2026-01-14T15:06:51.127Z Updated: 2026-01-14T15:19:46.837Z Open on db.gcve.eu Reference links https://github.com/outray-tunnel/outray/security/advisories/GHSA-3pqc-836w-jgr7 https://github.com/outray-tunnel/outray/commit/08c61495761349e7fd2965229c3faa8d7b1c1581	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-22819`	vulnerable	2026-06-08 07:51:13.998017	Outray has a Race Condition in main/apps/web/src/routes/api/$orgSlug/subdomains/index.ts MEDIUM (5.9) Outray openSource ngrok alternative. Prior to 0.1.5, this vulnerability allows a user i.e a free plan user to get more than the desired subdomains due to lack of db transaction lock mechanisms in main/apps/web/src/routes/api/$orgSlug/subdomains/index.ts. This vulnerability is fixed in 0.1.5. Published: 2026-01-14T18:04:33.426Z Updated: 2026-01-14T21:13:36.389Z Open on db.gcve.eu Reference links https://github.com/outray-tunnel/outray/security/advisories/GHSA-45hj-9x76-wp9g https://github.com/outray-tunnel/outray/commit/73e8a09575754fb4c395438680454b2ec064d1d6	Imported from gcve-enriched-dumps CVE data

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.