CVE-2026-42047: Inngest information disclosure (CVSS 8.6)

Description

Inngest is a platform for running event-driven and scheduled background functions with queueing, retries, and step orchestration. Versions 3.22.0 through 3.53.1 contain a vulnerability that allows unauthenticated remote attackers to exfiltrate environment variables from the host process via the serve() HTTP handler. The serve() handler implements GET, POST, and PUT methods. Requests using PATCH, OPTIONS, or DELETE fall through to a generic handler that returns diagnostic information. A change introduced in v3.22.0 caused this diagnostic response to include the contents of process.env, exposing any secrets, API keys, or credentials present in the environment. An application is vulnerable if its serve() endpoint is reachable via PATCH, OPTIONS, or DELETE requests, which is common in setups like Next.js Pages Router or Express's app.use(...). Not affected are Next.js App Router handlers that export only GET, POST, and PUT, and applications using the connect worker method. This issue has been fixed in version 3.54.0. To work around this issue if upgrading is not immediately possible, restrict the serve() endpoint at the framework or reverse-proxy layer to accept only GET, POST, and PUT. The Inngest serve() endpoint does not require any other HTTP methods.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeChanged

ConfidentialityHigh

IntegrityNone

AvailabilityNone

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Affected products

Inngest≥ 3.22.0 < 3.54.0

Remediation

Fixed in

Inngest≥ 3.54.0

Patch & vendor advisories

References

https://github.com/inngest/inngest-js/releases/tag/inngest%403.54.1PatchProduct
https://github.com/inngest/inngest-js/security/advisories/GHSA-2jf5-6wwv-vhxxMitigationVendor Advisory

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2026-42047 being actively exploited?

CVE-2026-42047 is not in the CISA KEV catalog. Its EPSS exploit probability is 0.55%.

How severe is CVE-2026-42047?

CVE-2026-42047 has a CVSS 3.1 base score of 8.6, rated high. EPSS estimates a 0.55% probability of exploitation.

Which products are affected by CVE-2026-42047?

Affected products include Inngest.

How do I fix CVE-2026-42047?

Upgrade affected software to a fixed version, for example Inngest 3.54.0 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-42047 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo