--- title: Security vulnerability in v3 TypeScript SDK | daily.dev description: Inngest disclosed CVE-2026-42047, a critical vulnerability in its TypeScript SDK (versions 3.22.0 through 3.53.1) that could expose environment variables... canonical: https://daily.dev/posts/security-vulnerability-in-v3-typescript-sdk-bbzl4mwud twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Security vulnerability in v3 TypeScript SDK | daily.dev og:description: Inngest disclosed CVE-2026-42047, a critical vulnerability in its TypeScript SDK (versions 3.22.0 through 3.53.1) that could expose environment variables... og:url: https://daily.dev/posts/security-vulnerability-in-v3-typescript-sdk-bbzl4mwud og:image: https://api.daily.dev/og/posts/BbzL4MwuD.png og:image:alt: Security vulnerability in v3 TypeScript SDK og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Security vulnerability in v3 TypeScript SDK **[Inngest Blog](https://daily.dev/sources/inngest)** · 8 min read · 0 upvotes · 0 comments ## Summary Inngest disclosed CVE-2026-42047, a critical vulnerability in its TypeScript SDK (versions 3.22.0 through 3.53.1) that could expose environment variables through an application's serve endpoint via PATCH, OPTIONS, or DELETE HTTP requests. Frameworks with explicit HTTP method mapping like Next.js App Router were safe, while others like Express.js, Cloudflare Workers, and Hono using generic handlers were vulnerable. Affected users should upgrade to v3.54.0 or later and rotate all environment variables and Inngest signing keys. The Python and Go SDKs and v4+ of the TypeScript SDK were unaffected. Inngest also outlined post-incident changes including expanded security auditing, a bug bounty program, and a new audit trails feature. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Which versions of the Inngest TypeScript SDK are affected by CVE-2026-42047? Versions 3.22.0 through 3.53.1 of the Inngest TypeScript SDK are affected. The vulnerability could expose environment variables through an application's serve endpoint when it responded to PATCH, OPTIONS, or DELETE HTTP requests. Version 3.54.0 or later contains the fix, and it is backwards compatible so upgrading is safe. Version 4.0 and later, plus the Python and Go SDKs, are unaffected. _Track SDK security advisories like this one on daily.dev before they turn into a production incident._ ### How do I know if my Inngest serve endpoint is vulnerable to CVE-2026-42047? An application is vulnerable if it uses Inngest TypeScript SDK version 3.22.0 through 3.53.1, has a serve endpoint, and that endpoint handles PATCH, OPTIONS, or DELETE HTTP methods. Frameworks that pass all HTTP methods to the serve handler generically, like Express.js, Cloudflare Workers, and Hono, are typically vulnerable, while Next.js App Router, which explicitly maps only GET, POST, and PUT, is safe. _Developers auditing framework-specific exposure like this compare mitigation guides on daily.dev._ ### What should I do after upgrading past a leaked environment variable vulnerability like CVE-2026-42047? Beyond upgrading to Inngest TypeScript SDK v3.54.0 or later, rotate all sensitive environment variables used in the affected application, including non-Inngest secrets, and rotate Inngest's signing key and event keys for every environment. Also review request logs for PATCH, DELETE, or OPTIONS requests to the serve endpoint to check for exploitation, and consider firewall rules using Inngest's published IP allow list. _Teams responding to secret-exposure incidents like this share remediation checklists on daily.dev._ ## Similar posts on daily.dev - [Injective SDK on npm infected with cryptocurrency wallet stealer](https://daily.dev/posts/injective-sdk-on-npm-infected-with-cryptocurrency-wallet-stealer-2u95ebyn1) · BleepingComputer · 0 upvotes · 0 comments - [Compromised Injective SDK npm Package Exfiltrates Wallet Key...](https://daily.dev/posts/compromised-injective-sdk-npm-package-exfiltrates-wallet-key--cbv0i2kiw) · Socket · 1 upvotes · 0 comments - [Injective npm Supply Chain Attack: 18 Packages Backdoored to Steal Crypto Wallet Keys](https://daily.dev/posts/injective-npm-supply-chain-attack-18-packages-backdoored-to-steal-crypto-wallet-keys-qvukjacsf) · StepSecurity · 0 upvotes · 0 comments --- Tags: [#inngest](https://daily.dev/tags/inngest), [#security](https://daily.dev/tags/security), [#typescript](https://daily.dev/tags/typescript) [View this post on daily.dev](https://daily.dev/posts/security-vulnerability-in-v3-typescript-sdk-bbzl4mwud) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Security vulnerability in v3 TypeScript SDK","url":"https://daily.dev/posts/security-vulnerability-in-v3-typescript-sdk-bbzl4mwud","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/security-vulnerability-in-v3-typescript-sdk-bbzl4mwud"},"datePublished":"2026-09-13T19:57:20.927Z","dateModified":"2026-10-15T02:22:37.143Z","description":"Inngest disclosed CVE-2026-42047, a critical vulnerability in its TypeScript SDK (versions 3.22.0 through 3.53.1) that could expose environment variables...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/4d20c532a1e35285fc59e0b35700f84e?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/4d20c532a1e35285fc59e0b35700f84e?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Inngest Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Inngest Blog","logo":"https://media.daily.dev/image/upload/s--ieZKUa5y--/c_limit,w_256/f_auto,q_auto/v1789329423/logos/inngest?_a=BAMAMicg0","url":"https://daily.dev/sources/inngest"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/security-vulnerability-in-v3-typescript-sdk-bbzl4mwud","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"inngest,security,typescript","timeRequired":"PT8M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Inngest Blog","item":"https://daily.dev/sources/inngest"},{"@type":"ListItem","position":3,"name":"Security vulnerability in v3 TypeScript SDK"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/security-vulnerability-in-v3-typescript-sdk-bbzl4mwud#faq","mainEntity":[{"@type":"Question","name":"Which versions of the Inngest TypeScript SDK are affected by CVE-2026-42047?","acceptedAnswer":{"@type":"Answer","text":"Versions 3.22.0 through 3.53.1 of the Inngest TypeScript SDK are affected. The vulnerability could expose environment variables through an application's serve endpoint when it responded to PATCH, OPTIONS, or DELETE HTTP requests. Version 3.54.0 or later contains the fix, and it is backwards compatible so upgrading is safe. Version 4.0 and later, plus the Python and Go SDKs, are unaffected. Track SDK security advisories like this one on daily.dev before they turn into a production incident."}},{"@type":"Question","name":"How do I know if my Inngest serve endpoint is vulnerable to CVE-2026-42047?","acceptedAnswer":{"@type":"Answer","text":"An application is vulnerable if it uses Inngest TypeScript SDK version 3.22.0 through 3.53.1, has a serve endpoint, and that endpoint handles PATCH, OPTIONS, or DELETE HTTP methods. Frameworks that pass all HTTP methods to the serve handler generically, like Express.js, Cloudflare Workers, and Hono, are typically vulnerable, while Next.js App Router, which explicitly maps only GET, POST, and PUT, is safe. Developers auditing framework-specific exposure like this compare mitigation guides on daily.dev."}},{"@type":"Question","name":"What should I do after upgrading past a leaked environment variable vulnerability like CVE-2026-42047?","acceptedAnswer":{"@type":"Answer","text":"Beyond upgrading to Inngest TypeScript SDK v3.54.0 or later, rotate all sensitive environment variables used in the affected application, including non-Inngest secrets, and rotate Inngest's signing key and event keys for every environment. Also review request logs for PATCH, DELETE, or OPTIONS requests to the serve endpoint to check for exploitation, and consider firewall rules using Inngest's published IP allow list. Teams responding to secret-exposure incidents like this share remediation checklists on daily.dev."}}]} ```