Skip to content
Threat Feed

Product

Vercel

1 brief RSS
high threat

Inngest SDK Exposes Environment Variables via Unhandled HTTP Methods

Inngest TypeScript SDK versions 3.22.0 through 3.53.1 expose environment variables via the serve() handler on unhandled HTTP methods, allowing unauthenticated remote attackers to exfiltrate environment variables from the host process via `PATCH`, `OPTIONS`, or `DELETE` requests to the `serve()` HTTP handler.

exploited inngest TypeScript SDK +2 environment-variable-exposure inngest cve-2026-42047
2r 1t 2i