CVE-2026-42047 Inngest TypeScript SDK exposes environment variables via serve() handler on unhandled HTTP methods

Inngest is a platform for running event-driven and scheduled background functions with queueing, retries, and step orchestration. Versions 3.22.0 through 3.53.1 contain a vulnerability that allows unauthenticated remote attackers to exfiltrate environment variables from the host process via the...

@b3dotfun/b3-api (>=0.0.42, <=0.0.102), @b3dotfun/sdk (>=0.0.27-alpha.1, <=0.1.70) +39 more potentially affected by CVE-2026-42047 via inngest (>=3.22.3, <=3.47.0)

inngest NPM version =3.22.3, =0.0.42, =0.0.27-alpha.1, =1.0.4, =0.0.26, =2.0.5, =0.0.3-canary.1, =0.1.2, =1.0.1-alpha.0, =1.0.1-alpha.0, =1.0.1-alpha.0, =1.0.1-alpha.0, =0.1.13, =1.0.1-alpha.0, =0.0.1, =1.0.1, =1.0.4-alpha.13 and more Source cves: CVE-2026-42047 Source advisory:...

@b3dotfun/b3-api (>=0.0.42, <=0.0.102), @b3dotfun/sdk (>=0.0.27-alpha.1, <=0.1.70) +39 more potentially affected by CVE-2026-42047 via inngest (>=3.22.3, <=3.47.0)

inngest NPM version =3.22.3, =0.0.42, =0.0.27-alpha.1, =1.0.4, =0.0.26, =2.0.5, =0.0.3-canary.1, =0.1.2, =1.0.1-alpha.0, =1.0.1-alpha.0, =1.0.1-alpha.0, =1.0.1-alpha.0, =0.1.13, =1.0.1-alpha.0, =0.0.1, =1.0.1, =1.0.4-alpha.13 and more Source cves: CVE-2026-42047 Source advisory:...