Inngest TypeScript SDK exposes environment variables via serve() handler on unhandled HTTP methods

Description

A vulnerability in the Inngest TypeScript SDK versions 3.22.0 through 3.53.1 allows unauthenticated remote attackers to exfiltrate environment variables from the host process via the serve() HTTP handler.

The serve() handler implements GET, POST, and PUT methods.

Recommendation

Update the inngest package to the latest compatible version. Followings are version details:

• Affected version(s): >= 3.22.0, < 3.54.0
• Patched version(s): 3.54.0

References

• GHSA-2jf5-6wwv-vhxx
• vercel.com
• www.inngest.com
• CVE-2026-42047
• CWE-200
• CWE-497
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• CleverTap Web SDK is vulnerable to DOM-based XSS via handleCustomHtmlPreviewPostMessageEvent function - CVE-2026-26861
• @rvf/set-get has a prototype pollution issue that's reachable via @rvf/core preprocessFormData (HTTP form data) - CVE-2026-44483
• OpenTelemetry JavaScript: Denial of service in `JaegerPropagator` via unhandled exception on a malformed header - CVE-2026-59892
• DbGate has cross site scripting via the SVG Icon String Handler component - CVE-2026-6216

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

inngest