CVE-2026-42047
1 advisory.
npm/inngest CVE-2026-42047: high 8.6, EPSS 0.55%
Inngest TypeScript SDK exposes environment variables via serve() handler on unhandled HTTP methods
Action: Upgrade inngest to 3.54.0 or later.
npm i inngest@3.54.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 3.22.0 | 3.54.0 | - |
Fixed versions
| 3.54.0 |
Sources
- osv: GHSA-2jf5-6wwv-vhxx
- https://github.com/inngest/inngest-js/security/advisories/GHSA-2jf5-6wwv-vhxx
- https://nvd.nist.gov/vuln/detail/CVE-2026-42047
- https://github.com/inngest/inngest-js
- https://github.com/inngest/inngest-js/releases/tag/inngest%403.54.1
- https://vercel.com/docs/deployment-protection#standard-protection
- https://vercel.com/kb/guide/how-do-i-delete-an-individual-deployment
- https://www.inngest.com/docs/events/creating-an-event-key
- https://www.inngest.com/docs/learn/security
- https://www.inngest.com/docs/learn/serving-inngest-functions
- https://www.inngest.com/docs/platform/manage/rotating-keys
- https://www.inngest.com/docs/platform/signing-keys
CVE-2026-42047 · published · modified · JSON