CVE-2026-54150: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in muxinc next-video
next-video is a library for adding video to Next.js applications. Prior to 2.8.1, the GET endpoint exported by next-video/request-handler and commonly mounted at /api/video accepts an unauthenticated url query parameter, while src/utils/utils.ts isRemote() treats any value without an HTTP or HTTPS prefix as a local path. src/request-handler.ts passes that value through src/assets.ts getAssetPath() to src/config.ts loadAsset(), which appends a JSON suffix and uses fs.readFile without canonicalizing the path or verifying that it remains inside the configured video folder. A remote attacker can therefore escape the intended asset directory and read JSON files accessible to the application process, including Next.js server-action encryption material, preview-mode keys, build manifests, route metadata, absolute paths, and application video asset identifiers. Applications that do not expose the runtime request handler are not affected through this route. This issue is fixed in version 2.8.1.
AI Analysis
Technical Summary
The next-video library for Next.js applications has a path traversal vulnerability (CWE-22) in versions before 2.8.1. The GET endpoint exported by next-video/request-handler accepts an unauthenticated url query parameter. The isRemote() utility treats any url without an HTTP or HTTPS prefix as a local path. This local path is passed through functions that append a JSON suffix and read the file using fs.readFile without canonicalizing or verifying the path remains within the configured video folder. Consequently, a remote attacker can escape the intended directory and read arbitrary JSON files accessible to the application process, including sensitive Next.js server-action encryption materials, preview-mode keys, build manifests, route metadata, absolute paths, and video asset identifiers. Applications not exposing the runtime request handler are not affected. The vulnerability is resolved in next-video version 2.8.1.
Potential Impact
An unauthenticated remote attacker can exploit this vulnerability to read arbitrary JSON files on the server running the next-video library. This can lead to exposure of sensitive application data such as encryption keys, preview-mode keys, build manifests, and route metadata. The impact is limited to information disclosure and does not require user interaction or privileges.
Mitigation Recommendations
Upgrade to next-video version 2.8.1 or later, where this path traversal vulnerability is fixed. Applications that do not expose the runtime request handler endpoint are not affected by this issue. No other mitigations are specified.
CVE-2026-54150: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in muxinc next-video
Description
next-video is a library for adding video to Next.js applications. Prior to 2.8.1, the GET endpoint exported by next-video/request-handler and commonly mounted at /api/video accepts an unauthenticated url query parameter, while src/utils/utils.ts isRemote() treats any value without an HTTP or HTTPS prefix as a local path. src/request-handler.ts passes that value through src/assets.ts getAssetPath() to src/config.ts loadAsset(), which appends a JSON suffix and uses fs.readFile without canonicalizing the path or verifying that it remains inside the configured video folder. A remote attacker can therefore escape the intended asset directory and read JSON files accessible to the application process, including Next.js server-action encryption material, preview-mode keys, build manifests, route metadata, absolute paths, and application video asset identifiers. Applications that do not expose the runtime request handler are not affected through this route. This issue is fixed in version 2.8.1.
CVSS v4.0
Score 6.9medium
Affected software
muxinc
next-video
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The next-video library for Next.js applications has a path traversal vulnerability (CWE-22) in versions before 2.8.1. The GET endpoint exported by next-video/request-handler accepts an unauthenticated url query parameter. The isRemote() utility treats any url without an HTTP or HTTPS prefix as a local path. This local path is passed through functions that append a JSON suffix and read the file using fs.readFile without canonicalizing or verifying the path remains within the configured video folder. Consequently, a remote attacker can escape the intended directory and read arbitrary JSON files accessible to the application process, including sensitive Next.js server-action encryption materials, preview-mode keys, build manifests, route metadata, absolute paths, and video asset identifiers. Applications not exposing the runtime request handler are not affected. The vulnerability is resolved in next-video version 2.8.1.
Potential Impact
An unauthenticated remote attacker can exploit this vulnerability to read arbitrary JSON files on the server running the next-video library. This can lead to exposure of sensitive application data such as encryption keys, preview-mode keys, build manifests, and route metadata. The impact is limited to information disclosure and does not require user interaction or privileges.
Mitigation Recommendations
Upgrade to next-video version 2.8.1 or later, where this path traversal vulnerability is fixed. Applications that do not expose the runtime request handler endpoint are not affected by this issue. No other mitigations are specified.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-11T21:15:33.871Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6aa8300055bf5e2cf5600a5e
Added to database: 09/14/2026, 17:33:52 UTC
Last enriched: 09/14/2026, 17:47:32 UTC
Last updated: 09/15/2026, 03:14:34 UTC
Views: 10
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.