CVE-2026-75524: Typescript Toctou Guard Then Insert Outside Transactioncve-2026-75524-typescript-toctou-guard-then-insert-outside-transaction
Check-then-insert race (TOCTOU/CWE-367): the availability/exclusivity guard is called with only a data object (no transaction handle) and outside any $DB.transaction(...) callback, while the same function performs the dependent insert on an autocommit connection. The guard's plain SELECT holds no row lock (no SELECT ... FOR UPDATE), so concurrent requests ca
