An information exposure vulnerability in Inngest versions 3.22.0 through 3.53.1 allows unauthenticated remote attackers to exfiltrate environment variables and sensitive credentials from the host process.

This is an exposure of sensitive information flaw, mapped to CWE-200 and CWE-497, where unauthenticated remote attackers can send specific HTTP requests to the serve handler and receive diagnostic data containing process environment variables.

A successful exploitation of this vulnerability can lead to the severe compromise of sensitive organizational assets, including database credentials, API keys, and cloud secrets stored within environment variables. This exposure presents significant compliance and security risks, potentially granting unauthorized access to connected downstream services. The CVSS score of 8.6 reflects the high severity of the remote attack vector and the confidentiality impact.

Immediate Action: Update the inngest package to version 3.54.0 or later immediately.

Proactive Monitoring: Monitor API gateway and reverse proxy logs for anomalous HTTP methods such as PATCH, OPTIONS, or DELETE directed at the Inngest serve endpoint.

Compensating Controls: Configure a Web Application Firewall or reverse proxy rule to restrict the serve endpoint to accept strictly GET, POST, and PUT methods if immediate updating is not feasible.

Public Exploit Available: No (false / unknown)

Given the high severity and the ease of remote access to environment variables, administrators must prioritize updating the Inngest JavaScript SDK to version 3.54.0 immediately. Applying the fix or the recommended HTTP method restrictions at the perimeter will effectively mitigate the risk of credential theft.