CVE-2026-54150
Fix: muxinc/next-video@73abf1dCVE-2026-54150 is a security vulnerability in next-video. O3 Security confirms whether CVE-2026-54150 is actually reachable in your code before you act, and blocks exploitation at runtime until you patch.
next-video: Unauthenticated arbitrary file read via /api/video request handler
Real-World Exposure
How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.
next-videonpmDescription
Impact
The HTTP route handler exported by next-video/request-handler — which the README instructs consumers to mount at /api/video — allows an unauthenticated remote attacker to read arbitrary .json files from the production filesystem of any application following the documented setup.
The handler's GET endpoint accepts a url query parameter and uses it to locate and serve a JSON asset descriptor from disk. The only guard between "remote URL" and "local file path" is a regex check for ^https?://. Any value that does not match that prefix is treated as a local path, .json is appended, and the file is read with fs.readFile and returned in the HTTP response — with no authentication, no path canonicalization, and no traversal guard.
On a typical Next.js deployment this exposes, at minimum:
- The Next.js Server Actions AES encryption key (
.next/server/server-reference-manifest.json) - The Next.js Preview/Draft Mode keys (
previewModeId,previewModeSigningKey,previewModeEncryptionKey) - Internal build manifests, route registries, and absolute runtime paths
- Application-specific asset metadata (e.g. Mux
uploadId,assetId,playbackIdvalues stored invideos/*.json)
Any application that mounted /api/video following the documented one-liner is affected.
Patches
2.8.1
Workarounds
Until a patched version is available, wrap the exported handler in your own route file and validate the url parameter before passing it through:
- Reject any
urlvalue that does not begin withhttps://, or that does not match a known allowlist of trusted remote hosts. - Alternatively, remove the
/api/videoroute entirely if your application only uses build-timeimportof local video files and does not use<Video src="https://...">with string URLs at runtime.
References
src/request-handler.ts— the vulnerable GET handlersrc/assets.ts—getAssetPath(), where the local-vs-remote branching occurssrc/utils/utils.ts—isRemote(), the sole guard between the two branchessrc/config.ts—loadAsset(), which performs the unconstrainedfs.readFile
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 📦npm | next-video | all versions | 2.8.1 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for next-video. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.
Fix
Update next-video to 2.8.1 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-54150 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 pinpoints whether CVE-2026-54150 is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.
Tailored to CVE-2026-54150. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is CVE-2026-54150 in your dependencies?
O3 detects CVE-2026-54150 across npm dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.