CVE-2026-54150: 
JavaScript Analyse et atténuation des vulnérabilités

CVE-2026-54150 is an unauthenticated arbitrary file read vulnerability in the next-video npm package (by Muxinc) affecting all versions up to and including 2.8.0. The flaw resides in the HTTP route handler exported by next-video/request-handler, which the library's README instructs users to mount at /api/video. An unauthenticated remote attacker can exploit this to read arbitrary .json files from the production server's filesystem. It was first published as a security advisory on June 12, 2026, and added to the GitHub Advisory Database on August 20, 2026. It carries a CVSS v4 base score of 6.9 (Medium) (GitHub Advisory).

The root cause is improper limitation of a pathname to a restricted directory (CWE-22 / path traversal), combined with exposure of sensitive information to an unauthorized actor (CWE-200). The handler's GET endpoint accepts a url query parameter; the sole guard between a remote URL and a local file path is a regex check for ^https?:// in src/utils/utils.ts (isRemote()). Any value not matching that prefix is treated as a local path, .json is appended, and the file is read via fs.readFile and returned in the HTTP response — with no authentication, no path canonicalization, and no traversal guard. The vulnerable code path flows through src/request-handler.ts → src/assets.ts (getAssetPath()) → src/config.ts (loadAsset()). No privileges or user interaction are required; the attack is network-accessible with low complexity (GitHub Advisory, Security Advisory).

Successful exploitation allows an unauthenticated attacker to read any .json file accessible to the Node.js process on the production filesystem. On a typical Next.js deployment, this exposes the Next.js Server Actions AES encryption key (.next/server/server-reference-manifest.json), Next.js Preview/Draft Mode keys (previewModeId, previewModeSigningKey, previewModeEncryptionKey), internal build manifests, route registries, absolute runtime paths, and application-specific Mux asset metadata (uploadId, assetId, playbackId). Compromise of these cryptographic keys could enable an attacker to forge server actions, bypass draft mode protections, or further pivot within the application environment (GitHub Advisory).

No public exploit code or in-the-wild exploitation has been reported as of the advisory publication date. The vulnerability requires no authentication, no special privileges, and no user interaction, making it trivially exploitable by any remote attacker against any application that mounted /api/video per the documented setup. The CVE status is listed as "Reserved" and no EPSS score or CISA KEV catalog entry has been identified for this CVE (GitHub Advisory, GitLab Advisory).

1. Reconnaissance: Identify Next.js applications using the next-video package (versions ≤ 2.8.0) that expose the /api/video route publicly. This can be done via passive scanning, reviewing public package.json files, or probing for the endpoint.
2. Probe the endpoint: Send a GET request to /api/video?url=test and observe whether a JSON response or a 404 is returned, confirming the handler is mounted.
3. Craft a path traversal payload: Supply a url parameter value that does not begin with https?:// and points to a sensitive file path (without the .json extension, as the handler appends it automatically). For example: /api/video?url=.next/server/server-reference-manifest
4. Read sensitive files: The handler resolves the path, appends .json, reads the file with fs.readFile, and returns its contents in the HTTP response. Targets of interest include:
   • .next/server/server-reference-manifest (AES encryption key for Server Actions)
   • .next/prerender-manifest (Preview/Draft Mode keys)
   • videos/<asset-name> (Mux asset metadata)
5. Leverage extracted secrets: Use recovered cryptographic keys to forge Next.js Server Actions requests, bypass Preview Mode authentication, or enumerate internal Mux asset identifiers for further abuse (GitHub Advisory, Security Advisory).

• Network: Unusual GET requests to /api/video with a url query parameter containing path-like values (e.g., .next/, ../, /etc/, server-reference-manifest) rather than https:// URLs; high volume of such requests from a single IP.
• Logs: Web server or Next.js access logs showing requests such as GET /api/video?url=.next/server/server-reference-manifest or GET /api/video?url=../../etc/passwd; HTTP 200 responses to these requests indicating successful file reads.
• File System: No direct file system artifacts are created by exploitation, but audit logs may show unexpected fs.readFile calls to paths outside the videos/ directory if application-level logging is enabled.
• Application Behavior: Unexpected use of Next.js Preview Mode or Server Actions from unknown origins following a period of suspicious /api/video requests, which may indicate key compromise and subsequent abuse (GitHub Advisory).

Upgrade next-video to version 2.8.1, which introduces the assertSafeAssetSource() function that validates all url parameters against the configured video folder before serving any file, and returns a 404 for any path resolving outside that directory (next-video v2.8.1, Patch Commit). If immediate upgrade is not possible, wrap the exported handler in a custom route file and reject any url value that does not begin with https:// or does not match a known allowlist of trusted remote hosts. Alternatively, remove the /api/video route entirely if your application only uses build-time imports of local video files and does not use string URLs at runtime (Security Advisory).