CVE-2026-54150: next-video: Unauthenticated arbitrary file read via /api/video request handler

The HTTP route handler exported by next-video/request-handler — which the README instructs consumers to mount at /api/video — allows an unauthenticated remote attacker to read arbitrary .json files from the production filesystem of any application following the documented setup.

The handler’s GET endpoint accepts a url query parameter and uses it to locate and serve a JSON asset descriptor from disk. The only guard between “remote URL” and “local file path” is a regex check for ^https?://. Any value that does not match that prefix is treated as a local path, .json is appended, and the file is read with fs.readFile and returned in the HTTP response — with no authentication, no path canonicalization, and no traversal guard.

On a typical Next.js deployment this exposes, at minimum:

• The Next.js Server Actions AES encryption key (.next/server/server-reference-manifest.json)
• The Next.js Preview/Draft Mode keys (previewModeId, previewModeSigningKey, previewModeEncryptionKey)
• Internal build manifests, route registries, and absolute runtime paths
• Application-specific asset metadata (e.g. Mux uploadId, assetId, playbackId values stored in videos/*.json)

Any application that mounted /api/video following the documented one-liner is affected.