{"action":"Upgrade inngest to 3.54.0 or later.","affected":[{"fixed":"3.54.0","introduced":"3.22.0"}],"component":"inngest","cve_ids":["CVE-2026-42047"],"ecosystem":"npm","epss":0.00383,"exploited":false,"fixed_versions":["3.54.0"],"ghsa_id":"GHSA-2jf5-6wwv-vhxx","id":"tcs_01M5KETCRVQGQ3P6KF10KH8KNC","modified_at":"2026-05-11T13:53:13.460971Z","published_at":"2026-05-05T18:13:52Z","references":["https://osv.dev/vulnerability/GHSA-2jf5-6wwv-vhxx","https://github.com/inngest/inngest-js/security/advisories/GHSA-2jf5-6wwv-vhxx","https://nvd.nist.gov/vuln/detail/CVE-2026-42047","https://github.com/inngest/inngest-js","https://github.com/inngest/inngest-js/releases/tag/inngest%403.54.1","https://vercel.com/docs/deployment-protection#standard-protection","https://vercel.com/kb/guide/how-do-i-delete-an-individual-deployment","https://www.inngest.com/docs/events/creating-an-event-key","https://www.inngest.com/docs/learn/security","https://www.inngest.com/docs/learn/serving-inngest-functions","https://www.inngest.com/docs/platform/manage/rotating-keys","https://www.inngest.com/docs/platform/signing-keys"],"severity":{"label":"high","score":8.6},"sources":[{"source":"osv","source_id":"GHSA-2jf5-6wwv-vhxx","url":"https://osv.dev/vulnerability/GHSA-2jf5-6wwv-vhxx"}],"summary":"Inngest TypeScript SDK exposes environment variables via serve() handler on unhandled HTTP methods"}