1vulnerability
- Critical0 (0.0%)
- High0 (0.0%)
- Medium0 (0.0%)
- Moderate1 (100.0%)
- Low0 (0.0%)
next-video
Ecosystem: npm
Downloads: 173.69 K
- 0CriticalAffects 0 versions
- 0HighAffects 0 versions
- 0MediumAffects 0 versions
- 1ModerateAffects 1 version
- 0LowAffects 0 versions
Monthly breakdown
- 1 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 1
- Low: 0
Vulnerabilities (1)
Known vulnerabilities affecting next-video, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| GHSA-2p39-2jf3-fv2q | Moderate | next-video: Unauthenticated arbitrary file read via /api/video request handler### Impact The HTTP route handler exported by `next-video/request-handler` — which the README instructs consumers to mount at `/api/video` — allows an unauthenticated remote attacker to read arbitrary `.json` files from the production filesystem of any application following the documented setup. The handler's `GET` endpoint accepts a `url` query parameter and uses it to locate and serve a JSON asset descriptor from disk. The only guard between "remote URL" and "local file path" is a regex check for `^https?://`. Any value that does not match that prefix is treated as a local path, `.json` is |
| GitHub (opens in a new tab) |
- GHSA-2p39-2jf3-fv2qModeratenext-video: Unauthenticated arbitrary file read via /api/video request handler
< 2.8.1
### Impact The HTTP route handler exported by `next-video/request-handler` — which the README instructs consumers to mount at `/api/video` — allows an unauthenticated remote attacker to read arbitrary `.json` files from the production filesystem of any application following the documented setup. The handler's `GET` endpoint accepts a `url` query parameter and uses it to locate and serve a JSON asset descriptor from disk. The only guard between "remote URL" and "local file path" is a regex check for `^https?://`. Any value that does not match that prefix is treated as a local path, `.json` is
CVE: CVE-2026-54150