A serverless uptime monitoring solution exported sensitive worker configuration, including credentials, from the same module that also exported safe page configuration. The worker configuration was imported directly in a client‑side component, causing the entire object to be bundled and served to all visitors. This flaw exposed confidential data to anyone who could load the page, resulting in a direct privacy breach.

The vendor lyc8503’s UptimeFlare application is affected. All deployments that were built from the codebase before the patch commit 377a596—including any distributed versions that did not separate workerConfig from client‑visible modules—must be considered vulnerable.

The CVSS score of 7.5 signals a high severity assessment. The EPSS score of less than 1% indicates a very low probability that this vulnerability will be actively exploited at this time, and the vulnerability is not currently tracked by the CISA KEV catalog. The most likely attack vector is simple: a malicious or curious user loads the application and inspects the JavaScript bundle to recover exposed credentials, with no authentication or privileged access required. The harm is limited to confidentiality compromise; it does not currently allow further actions such as code execution or denial of service.