CVE-2026-63642
MagicMirror newsfeed Socket.IO notification allows blind server-side request forgery
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, checkArticleUrl in defaultmodules/newsfeed/node_helper.js accepts the CHECK_ARTICLE_URL notification through the unauthenticated Socket.IO namespace /newsfeed and performs fetch(url, { method: "HEAD" }) without validating the attacker-controlled URL. The helper returns ARTICLE_URL_STATUS containing the URL and framing result, providing a response and timing oracle that can identify internal hosts and ports and trigger side effects on services that react to HEAD requests. This issue is fixed in version 2.37.0.
| CWE | CWE-918 |
| Vendor | magicmirrororg |
| Product | magicmirror |
| Published | Aug 18, 2026 |
Stay Ahead of the Next One
Get instant alerts for magicmirrororg magicmirror
Be the first to know when new unknown vulnerabilities affecting magicmirrororg magicmirror are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
MagicMirrorOrg / MagicMirror
< 2.37.0
References
github.com: https://github.com/MagicMirrorOrg/MagicMirror/security/advisories/GHSA-998g-7v5w-cr7g github.com: https://github.com/MagicMirrorOrg/MagicMirror/pull/4169 github.com: https://github.com/MagicMirrorOrg/MagicMirror/commit/58c2a5e675a7d367b64d72e1d35680d202ff5c9f github.com: https://github.com/MagicMirrorOrg/MagicMirror/releases/tag/v2.37.0