A vulnerability in the Inngest TypeScript SDK versions 3.22.0 through 3.53.1 allows unauthenticated remote attackers to exfiltrate environment variables via the serve() HTTP handler when accessed with unhandled HTTP methods such as PATCH, OPTIONS, or DELETE. This occurs because the diagnostic response for these methods includes the contents of process.env, exposing secrets and credentials. The issue is fixed in version 3.54.0.