CVE-2026-29779CWE-200

UptimeFlare: Montior config / Credentials in `workerConfig` exposed in client-side JavaScript bundle

High · published March 7, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
41.2
In the wild
Unconfirmed
What it is

UptimeFlare is a serverless uptime monitoring & status page solution, powered by Cloudflare Workers. Prior to commit 377a596, configuration file uptime.config.ts exports both pageConfig (safe for client use) and workerConfig (server-only, contains sensitive data) from the same module. Due to pages/incidents.tsx importing and using workerConfig directly inside client-side component code, the entire workerConfig object was included in the client-side JavaScript bundle served to all visitors. This issue has been patched via commit 377a596.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00489 · 41.2th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2026-03-07T15:19Z
EPSS history
Timeline
  • 07 MAR 15:19Z
    UptimeFlare: Montior config / Credentials in `workerConfig` exposed in client-side JavaScript bundle
    cvelistv5