CVE-2026-54150

### Impact The HTTP route handler exported by `next-video/request-handler` — which the README instructs consumers to mount at `/api/video` — allows an unauthenticated remote attacker to read arbitrary `.json` files from the production filesystem of any application following the documented setup. The handler's `GET` endpoint accepts a `url` query parameter and uses it to locate and serve a JSON asset descriptor from disk. The only guard between "remote URL" and "local file path" is a regex check for `^https?://`. Any value that does not match that prefix is treated as a local path, `.json` is appended, and the file is read with `fs.readFile` and returned in the HTTP response — with no authentication, no path canonicalization, and no traversal guard. On a typical Next.js deployment this exposes, at minimum: - The **Next.js Server Actions AES encryption key** (`.next/server/server-reference-manifest.json`) - The **Next.js Preview/Draft Mode keys** (`previewModeId`, `previewModeSigningKey`, `previewModeEncryptionKey`) - Internal build manifests, route registries, and absolute runtime paths - Application-specific asset metadata (e.g. Mux `uploadId`, `assetId`, `playbackId` values stored in `videos/*.json`) Any application that mounted `/api/video` following the documented one-liner is affected. ### Patches 2.8.1 ### Workarounds Until a patched version is available, wrap the exported handler in your own route file and validate the `url` parameter before passing it through: - Reject any `url` value that does not begin with `https://`, or that does not match a known allowlist of trusted remote hosts. - Alternatively, remove the `/api/video` route entirely if your application only uses build-time `import` of local video files and does not use `<Video src="https://...">` with string URLs at runtime. ### References - `src/request-handler.ts` — the vulnerable GET handler - `src/assets.ts` — `getAssetPath()`, where the local-vs-remote branching occurs - `src/utils/uti