Outray openSource ngrok alternative. Prior to 0.1.5, a TOCTOU race condition vulnerability allows a user to exceed the set number of active tunnels in their subscription plan. This vulnerability is fixed in 0.1.5.

Affected: npm: outray

### Summary

A TOCTOU race condition vulnerability allows a user to exceed the set number of active tunnels in their subscription plan.

### Details

Affected conponent: `apps/web/src/routes/api/tunnel/register.ts` - `/tunnel/register` endpoint code-:

```ts // Check if tunnel already exists in database const [existingTunnel] = await db .select() .from(tunnels) .where(eq(tunnels.url, tunnelUrl));

const isReconnection = !!existingTunnel;

console.log( `[TUNNEL LIMIT CHECK] Org: ${organizationId}, Tunnel: ${tunnelId}`, ); console.log( `[TUNNEL LIMIT CHECK] Is Reconnection: ${isReconnection}`, ); console.log( `[TUNNEL LIMIT CHECK] Plan: ${currentPlan}, Limit: ${tunnelLimit}`, );

// Check limits only for NEW tunnels (not reconnections) if (!isReconnection) { // Count active tunnels from Redis SET const activeCount = await redis.scard(setKey); console.log( `[TUNNEL LIMIT CHECK] Active count in Redis: ${activeCount}`, );

// The current tunnel is NOT yet in the online_tunnels set (added after successful registration) // So we check if activeCount >= limit (not >) if (activeCount >= tunnelLimit) { console.log( `[TUNNEL LIMIT CHECK] REJECTED - ${activeCount} >= ${tunnelLimit}`,…