get-port

Summary It is assumed that there is a race condition relevant to this line: https://github.com/sindresorhus/get-port/blob/5c3cfe828bac345fb30b13211164708d97cb033a/index.js#L134 when the user sends a preferred port range (via the param). Analysis 1. Assuming that the user has previously called and acquired some available ports within the range. 2. Assuming that the loop at this line would iterate over the already-assigned ports. 3. Notice that at this line comes before the check, it would indeed proceed to the point where it attempts to bind to that port. 4. Assuming that the user then attempts to bind to the port, which is in use by . Therefore the race condition would be triggered. A PoC Sample code: Sample invocation (as of v7.1.0): Proposed fix ~Just to check against the assignment records () before attempting to bind to a non-zero port.~ Edit:** Hmm sorry that might not look that straightforward as there seem to be other possible causes of race conditions as well.