CVE-2026-54150

next-video is a library for adding video to Next.js applications. Prior to 2.8.1, the GET endpoint exported by next-video/request-handler and commonly mounted at /api/video accepts an unauthenticated url query parameter, while src/utils/utils.ts isRemote treats any value without an HTTP or HTTPS...

ROOT-APP-NPM-AIKIDO-2026-10755 AIKIDO-2026-10755 in next - Patched by Root

Root has patched AIKIDO-2026-10755 in the next package for Root:npm. Multiple fixed versions available...