Executive brief
next-video is a React component used in Next.js applications to optimize and deliver video content. The component exposes an HTTP endpoint (typically mounted at /api/video) that is unauthenticated by default and allows attackers to download arbitrary JSON files from the server's filesystem, including encryption keys for Next.js server actions and authentication tokens used for draft/preview mode. Any application using the documented setup is vulnerable to data exposure without requiring credentials or user interaction.
Technical details
The vulnerability is a path traversal / arbitrary file read flaw in the next-video request handler's GET endpoint. The handler accepts a `url` query parameter and uses a regex check for `^https?://` to determine if the value is a remote URL or a local path. Local paths are treated as file references, `.json` is appended, and the file is read using `fs.readFile` and returned in the HTTP response. Because there is no path canonicalization, no traversal guard (e.g., checking that resolved paths remain within an allowed directory), and no authentication, attackers can supply path traversal sequences to read arbitrary JSON files on the filesystem, including Next.js internal files containing encryption keys and secrets. The attack requires network access to the /api/video endpoint but no authentication or user interaction. Patches are available in version 2.8.1, which implements proper input validation and path boundary checks.
Affected products
- muxinc next-video <= 2.8.0
Timeline
- 2026-06-12: disclosed: Advisory GHSA-2p39-2jf3-fv2q published
- 2026-08-20: advisory: Advisory published on OSV and GitHub with CVSS 4.0 (Medium)
- 2026-06-08: patched: Fix committed; version 2.8.1 released with path validation and traversal guards