The vulnerability allows unauthenticated remote attackers to extract environment variables from the host process. This exposure occurs through the serve() HTTP handler in the Inngest TypeScript SDK, where unhandled HTTP methods return diagnostic information that unintentionally includes the contents of process.env. The leakage can reveal secrets, API keys, or credentials, leading to credential theft.

Vendors and products affected are Inngest’s JavaScript SDK (inngest:inngest-js). Versions 3.22.0 through 3.53.1 are vulnerable; the issue is resolved in version 3.54.0. Deployments that expose the serve() endpoint via PATCH, OPTIONS, or DELETE requests – common in frameworks such as Next.js Pages Router or Express's app.use(...) – are at risk. Next.js App Router handlers that export only GET, POST, and PUT, and applications using the connect worker method, are not affected.

The CVSS score of 8.6 indicates a high severity of this weakness. EPSS is not available, but the absence of authentication requirements and the ability to glean environment variables make exploitation straightforward. The vulnerability is listed as not in CISA KEV, but its potential to compromise credentials warrants immediate attention. Attackers can simply send unauthenticated PATCH, OPTIONS, or DELETE requests to the serve() endpoint to obtain environment data, leveraging the generic diagnostic handler introduced in v3.22.0.