CVE-2026-54150

MEDIUMCVSS · not yet scored
—
EchelonGraph verdictMonitorLow exploitation likelihood right now — keep watching.
  • No CVSS published and no exploitation signals yet
CISA-KEV: Not listedEPSS PROB: —CVSS v2: —Exploit: None knownExposed: 0

No vendor fix yet — apply a workaround or compensating control (WAF / firewall / segmentation) and watch for a patch.

next-video: Unauthenticated arbitrary file read via /api/video request handler

Impact

The HTTP route handler exported by next-video/request-handler — which the README instructs consumers to mount at /api/video — allows an unauthenticated remote attacker to read arbitrary .json files from the production filesystem of any application following the documented setup.

The handler's GET endpoint accepts a url query parameter and uses it to locate and serve a JSON asset descriptor from disk. The only guard between "remote URL" and "local file path" is a regex check for ^https?://. Any value that does not match that prefix is treated as a local path, .json is appended, and the file is read with fs.readFile and returned in the HTTP response — with no authentication, no path canonicalization, and no traversal guard.

On a typical Next.js deployment this exposes, at minimum:

  • The Next.js Server Actions AES encryption key (.next/server/server-reference-manifest.json)
  • The Next.js Preview/Draft Mode keys (previewModeId, previewModeSigningKey, previewModeEncryptionKey)
  • Internal build manifests, route registries, and absolute runtime paths
  • Application-specific asset metadata (e.g. Mux uploadId, assetId, playbackId values stored in videos/*.json)

Any application that mounted /api/video following the documented one-liner is affected.

Patches

2.8.1

Workarounds

Until a patched version is available, wrap the exported handler in your own route file and validate the url parameter before passing it through:

  • Reject any url value that does not begin with https://, or that does not match a known allowlist of trusted remote hosts.
  • Alternatively, remove the /api/video route entirely if your application only uses build-time import of local video files and does not use ` with string URLs at runtime.

References

  • src/request-handler.ts — the vulnerable GET handler
  • src/assets.ts — getAssetPath(), where the local-vs-remote branching occurs
  • src/utils/utils.ts — isRemote(), the sole guard between the two branches
  • src/config.ts — loadAsset(), which performs the unconstrained fs.readFile`

CVSS v3
—
EchelonGraph score
Not yet assessedNo source has published severity data for this CVE yet — no CVSS score from NVD or a CNA, no GitHub advisory, and it is not in CISA KEV. This is not a rating of zero; we cannot assess it yet.
EG Score
—
EG Risk
—
EPSS PROB
—
EPSS %ILE
—
KEV
Not listed

Published

August 20, 2026

Last Modified

August 20, 2026

Vendor Advisories for CVE-2026-54150(1)

These vendors published their own advisory mentioning this CVE — often with vendor-specific remediation steps + affected product lists not in NVD.

Data Freshness Timeline

(refreshed 1× in last 7d / 1× in last 30d)

Each row is a source pipeline that fetched or updated this CVE on that date, with what changed. For example, "NVD update" means NVD published or revised its analysis for this CVE; "MITRE cvelistV5" means we ingested or refreshed it from the CNA feed. Most recent first.

  1. 2026-08-20 18:42 UTCEG score recompute

Frequently asked(3)

What is CVE-2026-54150?
CVE-2026-54150 is a medium vulnerability published on August 20, 2026. next-video: Unauthenticated arbitrary file read via /api/video request handler Impact The HTTP route handler exported by next-video/request-handler — which the README instructs consumers to mount at /api/video — allows an unauthenticated remote attacker to read arbitrary .json files from the…
When was CVE-2026-54150 disclosed?
CVE-2026-54150 was first published in the National Vulnerability Database on August 20, 2026. EchelonGraph re-ingests CVE updates from NVD on a 2-hour cycle, so this page reflects the latest published state.
How do I remediate CVE-2026-54150?
Patch to the fixed version published by the affected vendor. Where vendor advisories exist for CVE-2026-54150, EchelonGraph cross-links them in the Vendor Advisories panel below — those typically contain the canonical remediation steps, fixed version numbers, and any vendor-specific mitigations.

Dependency Blast Radius

Explore the affected products and dependency analysis for CVE-2026-54150

Explore →

Is Your Infrastructure Affected by CVE-2026-54150?

EchelonGraph automatically scans your cloud infrastructure and maps CVE exposure using blast radius analysis.

Start Free Scan →Browse All CVEs