CVE-2026-42047 - Vulnerability Analysis

Overview

Inngest 3.22.0 through 3.53.1 contains an information disclosure vulnerability caused by exposing process.env in diagnostic responses of serve() HTTP handler for PATCH, OPTIONS, or DELETE requests, letting unauthenticated remote attackers exfiltrate environment variables, exploit requires serve() endpoint reachable via these HTTP methods.

Severity & Score

Impact

Unauthenticated attackers can exfiltrate sensitive environment variables, including secrets and API keys, leading to potential full system compromise.

Mitigation

Upgrade to version 3.54.0 or later; alternatively, restrict serve() endpoint to only accept GET, POST, and PUT requests at framework or reverse-proxy layer.

References

• https://github.com/inngest/inngest-js/security/advisories/GHSA-2jf5-6wwv-vhxx
• https://github.com/inngest/inngest-js/releases/tag/inngest%403.54.1

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner