GHSA-2p39-2jf3-fv2q next-video: Unauthenticated arbitrary file read via /api/video request handler

• npm next-video: < 2.8.1 → fixed in 2.8.1

Impact The HTTP route handler exported by `next-video/request-handler` — which the README instructs consumers to mount at `/api/video` — allows an unauthenticated remote attacker to read arbitrary `.json` files from the production filesystem of any application following the documented setup. The handler's `GET` endpoint accepts a `url` query parameter and uses it to locate and serve a JSON asset descriptor from disk. The only guard between "remote URL" and "local file path" is a regex check for `^https?://`. Any value that does not match that prefix is treated as a local path, `.json` is appended, and the file is read with `fs.readFile` and returned in the HTTP response — with no authentication, no path canonicalization, and no traversal guard. On a typical Next.js deployment this exposes, at minimum: • The Next.js Server Actions AES encryption key (`.next/server/server-reference-manifest.json`) • The Next.js Preview/Draft Mode keys (`previewModeId`, `previewModeSigningKey`, `previewModeEncryptionKey`) • Internal build manifests, route registries, and absolute runtime paths • Application-specific asset metadata (e.g. Mux `uploadId`, `assetId`, `playbackId` values stored in `videos/*.json`) Any application that mounted `/api/video` following the documented one-liner is affected. Patches 2.8.1 Workarounds Until a patched version is available, wrap the exported handler in your own route file and validate the `url` parameter before passing it through: • Reject any `url` value that does not begin with `https://`, or that does not match a known allowlist of trusted remote hosts. • Alternatively, remove the `/api/video` route entirely if your application only uses build-time `import` of local video files and does not use `` with string URLs at runtime. References • `src/request-handler.ts` — the vulnerable GET handler • `src/assets.ts` — `getAssetPath()`, where the local-vs-remote branching occurs • `src/utils/utils.ts` — `isRemote()`, the sole guard between the two branches • `src/config.ts` — `loadAsset()`, which performs the unconstrained `fs.readFile`