CVE-2026-54150: next-video Path Traversal Vulnerability

CVE-2026-54150 Overview

CVE-2026-54150 is a path traversal vulnerability [CWE-22] in next-video, a library for adding video to Next.js applications. Versions prior to 2.8.1 expose an unauthenticated GET endpoint at /api/video that accepts a url query parameter without canonicalizing the resulting file path. Remote attackers can escape the configured video asset directory and read arbitrary JSON files accessible to the Next.js server process. Exposed data can include server-action encryption material, preview-mode keys, build manifests, route metadata, and absolute filesystem paths. The maintainers released a fix in version 2.8.1.

Critical Impact
Unauthenticated remote attackers can read sensitive JSON files, including Next.js server-action encryption keys and build metadata, from any application exposing the next-video request handler.

Affected Products

next-video versions prior to 2.8.1
Next.js applications mounting next-video/request-handler (commonly at /api/video)
Applications relying on src/utils/utils.tsisRemote() classification for asset sources

Discovery Timeline

2026-09-14 - CVE-2026-54150 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-54150

Vulnerability Analysis

The vulnerability resides in the request handler exported by next-video/request-handler. The GET route accepts a caller-supplied url query parameter and forwards it through getAssetPath() in src/assets.ts to loadAsset() in src/config.ts. The loadAsset() function appends a .json suffix and calls fs.readFile on the resulting path. Because the input is never canonicalized or validated against the configured folder, sequences such as ../../../ traverse outside the intended video directory. The process reads any JSON file the Next.js runtime can access.

Root Cause

The isRemote() helper in src/utils/utils.ts classifies any string without an http:// or https:// prefix as a local path. Local paths are then joined to the configured video folder without checking that the resolved absolute path remains inside that folder. The absence of a boundary check between path.resolve() output and the configured folder allows relative traversal segments to escape the intended directory.

Attack Vector

An unauthenticated remote attacker sends a crafted GET /api/video?url=<traversal_payload> request. The handler reads the target JSON file from disk and returns its contents in the response. Applications that do not expose the runtime request handler are not affected through this route.

typescript

// Security patch in src/assets.ts (v2.8.1)
// Throws if `url` resolves outside the configured video `folder`. Remote URLs pass through.
export async function assertSafeAssetSource(url: string) {
  if (isRemote(url)) return;

  const { folder } = await getVideoConfig();
  if (!folder) throw new Error('Missing video `folder` config.');

  const folderAbs = path.resolve(cwd(), folder);
  const assetAbs = path.resolve(cwd(), url);
  const rel = path.relative(folderAbs, assetAbs);
  if (rel === '' || rel.startsWith('..') || path.isAbsolute(rel)) {
    throw new Error('Asset path is outside the configured video folder.');
  }
}

Source: GitHub Commit 73abf1d

Detection Methods for CVE-2026-54150

Indicators of Compromise

HTTP requests to /api/video (or any custom mount of next-video/request-handler) containing url values with ../ sequences, absolute paths, or encoded traversal payloads such as %2e%2e%2f.
Access log entries referencing the url parameter that resolve to filenames outside the configured video folder.
Application-level fs.readFile calls targeting paths ending in .json that fall outside the video asset directory.

Detection Strategies

Inspect web server and reverse-proxy logs for GET requests to the request-handler route where the url query parameter contains path traversal tokens.
Add a WAF or middleware rule that rejects requests to next-video routes whose url parameter is not a valid remote URL or a path constrained to the video folder.
Audit runtime file access telemetry for reads of .json files in application root, .next/, or configuration directories driven by the Node.js process handling /api/video.

Monitoring Recommendations

Enable request logging for the next-video handler and alert on non-2xx responses or oversized responses tied to the url parameter.
Correlate reads of sensitive files such as Next.js manifest.json, server-action keys, and preview-mode configuration with inbound HTTP requests.
Track deployed versions of next-video across build pipelines and alert when versions earlier than 2.8.1 appear in production dependencies.

How to Mitigate CVE-2026-54150

Immediate Actions Required

Upgrade next-video to version 2.8.1 or later in all Next.js applications.
Rotate Next.js server-action encryption material and preview-mode keys if the handler was publicly reachable before patching.
Audit access logs for prior exploitation attempts against the /api/video endpoint.

Patch Information

The fix is included in next-video 2.8.1. Commit 73abf1d introduces assertSafeAssetSource(), which resolves the requested path relative to the configured video folder and rejects any path that escapes it. See the GitHub Security Advisory GHSA-2p39-2jf3-fv2q and the GitHub Release v2.8.1 for release details.

Workarounds

Remove or gate the next-video/request-handler route if upgrading immediately is not possible.
Place upstream middleware or a WAF rule in front of /api/video that validates the url parameter against an allowlist of remote URLs or asset filenames.
Restrict the Node.js process filesystem permissions so it cannot read sensitive JSON files outside the video folder.

bash

# Upgrade next-video to the patched release
npm install next-video@^2.8.1
# or
pnpm add next-video@^2.8.1
# or
yarn add next-video@^2.8.1