Executive brief
The Inngest TypeScript SDK's serve() handler, which is used to process workflow requests, exposes sensitive environment variables (including API keys and credentials) when accessed via HTTP methods it doesn't officially support (PATCH, OPTIONS, DELETE). An unauthenticated attacker can retrieve these secrets directly over the network, compromising any credentials stored in the environment.
Technical details
The vulnerability is an information disclosure flaw (CWE-200, CWE-497) in the Inngest TypeScript SDK's serve() HTTP handler. The serve() function is designed to handle GET, POST, and PUT requests; however, requests using PATCH, OPTIONS, or DELETE methods fall through to a generic diagnostic handler introduced in v3.22.0. This fallback handler was coded to return the contents of process.env in its response, exposing all environment variables. The attack is unauthenticated and requires only network access to the serve() endpoint and that the framework routing configuration forwards unsupported HTTP methods to the handler (true by default in Next.js Pages Router and Express with app.use()). An attacker can trivially exfiltrate secrets including Inngest signing keys, event keys, and any other credentials in the environment. The vulnerability was fixed in version 3.54.0 and all 4.x releases; a patch is also backported to the 3.x release line.
Affected products
- Inngest inngest >=3.22.0, <3.54.0
Timeline
- 2026-05-05: disclosed: Vulnerability published as GHSA-2jf5-6wwv-vhxx
- 2026-04-27: patched: Fix released in inngest@3.54.0 and inngest@3.54.1
References
- https://github.com/inngest/inngest-js/security/advisories/GHSA-2jf5-6wwv-vhxx
- https://github.com/inngest/inngest-js
- https://github.com/inngest/inngest-js/releases/tag/inngest%403.54.1
- https://vercel.com/docs/deployment-protection
- https://vercel.com/kb/guide/how-do-i-delete-an-individual-deployment
- https://www.inngest.com/docs/events/creating-an-event-key