CVSS 4.0
6.3 mediumCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:NCVE-2026-22820
Medium (6.3) in outray outray. EPSS 0.2% chance of exploitation in the next 30 days. Fixed in outray 0.1.5.
Outray openSource ngrok alternative. Prior to 0.1.5, a TOCTOU race condition vulnerability allows a user to exceed the set number of active tunnels in their subscription plan. This vulnerability is fixed in 0.1.5.
Severity
CVSS 3.1
3.7 lowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N- EPSS
- 0.2% chance of exploitation in the next 30 days; higher than 10% of CVEs (scores of 2026-10-31)
- CWE
- CWE-367
- Published
- Modified
- Record from
- the NVD, synced
Affected
- outray:outray
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-3pqc-836w-jgr7 | npm | outray | <0.1.5 | 0.1.5 |