Inngest-js versions from 3.22.0 up to but not including 3.54.0 contain a vulnerability (CVE-2026-42047) where the serve() HTTP handler improperly exposes environment variables when handling PATCH, OPTIONS, or DELETE requests. This occurs because the diagnostic handler returns process.env contents, leaking sensitive information such as secrets and API keys. The vulnerability affects applications where the serve() endpoint is reachable via these HTTP methods, which is typical in certain web frameworks. The vulnerability has a CVSS 3.1 score of 8.6 (high severity) and is resolved in version 3.54.0. If upgrading is not immediately possible, restricting allowed HTTP methods to GET, POST, and PUT on the serve() endpoint mitigates the risk.

This vulnerability allows unauthenticated remote attackers to access sensitive environment variables, including secrets, API keys, and credentials, from the host process. The exposure can lead to compromise of confidential data and potentially further attacks leveraging leaked credentials. The vulnerability does not affect availability or integrity but has a high confidentiality impact. It requires no privileges or user interaction and can be exploited remotely over the network.

A fixed version (3.54.0) of inngest-js is available and should be applied to remediate this vulnerability. If upgrading immediately is not feasible, restrict the serve() endpoint at the application framework or reverse-proxy level to accept only GET, POST, and PUT HTTP methods, as the serve() handler does not require other methods. This restriction prevents the diagnostic handler from exposing environment variables via PATCH, OPTIONS, or DELETE requests.