High, CVSS 8.6npmAmendedPublished
Inngest TypeScript SDK exposes environment variables via serve() handler on unhandled HTTP methods
CVE-2026-42047 · GHSA-2jf5-6wwv-vhxx
- Affected
- npm inngest >= 3.22.0, < 3.54.0
- Fixed in
- 3.54.0· Vendor fix available
- Issue
- A vulnerability in the Inngest TypeScript SDK versions 3.22.0 through 3.53.1 allows unauthenticated remote attackers to exfiltrate environment variables from the host process via the serve() HTTP handler. The serve() handler implements GET, POST, and PUT methods. Requests using PATCH, OPTIONS, or DELETE fall through to a generic handler that returns diagnostic information. A change introduced in v3.22.0 caused this diagnostic response to include the contents of process.env, exposing any secrets, API keys, or credentials present in the environment. Who is affected An application is vulnerable if all of the following are true: - It uses inngest SDK version = 3.22.0, <= 3.53.1 (inclusive) - Its serve() endpoint is reachable via PATCH, OPTIONS, or DELETE requests. Please check your framework's implementation for the serve handler (documentation) to asses whether it handles these HTTP methods. Common vulnerable configurations include: - Next.js Pages Router, which forwards all…
Recommended action: Upgrade to 3.54.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.