Threats affecting pkg:npm/inngest/inngest-js

A vulnerability in inngest-js versions 3.22.0 through 3.53.1 allows unauthenticated remote attackers to exfiltrate environment variables via the serve() HTTP handler when accessed with PATCH, OPTIONS, or DELETE requests. This exposure occurs because the diagnostic response to these methods includes the full contents of process.env, potentially leaking secrets, API keys, or credentials. Applications exposing the serve() endpoint to these HTTP methods are vulnerable, which is common in some frameworks like Next.js Pages Router or Express using app.use(...