CVE-2026-22819: Outray

Low severity, CVSS 3.1. EPSS: 0.2% chance of exploitation in the next 30 days.

Outray openSource ngrok alternative. Prior to 0.1.5, this vulnerability allows a user i.e a free plan user to get more than the desired subdomains due to lack of db transaction lock mechanisms in main/apps/web/src/routes/api/$orgSlug/subdomains/index.ts. This vulnerability is fixed in 0.1.5.

Affected products

• Outray Outray: before 0.1.5 (fixed in 0.1.5)

Published 2026-01-14. Last modified 2026-06-17.