Vulnerability · Published Aug 18, 2026 · Assigned by GitHub_M

CVE-2026-63642MagicMirror newsfeed Socket.IO notification allows blind server-side request forgery

Medium 6.3

In plain English

A medium-severity server-side request forgery in MagicMirror from MagicMirrorOrg. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.3Medium

Exploit odds (30 days)0.5%top 57.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling1Public PoC

Official description

MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, checkArticleUrl in defaultmodules/newsfeed/node_helper.js accepts the CHECK_ARTICLE_URL notification through the unauthenticated Socket.IO namespace /newsfeed and performs fetch(url, { method: "HEAD" }) without validating the attacker-controlled URL. The helper returns ARTICLE_URL_STATUS containing the URL and framing result, providing a response and timing oracle that can identify internal hosts and ports and trigger side effects on services that react to HEAD requests. This issue is fixed in version 2.37.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	magicmirror	2.37.0	GHSA-998g-7v5w-cr7g

Affected products (as reported)

Vendor	Product	Versions
MagicMirrorOrg	MagicMirror	< 2.37.0

Weakness: CWE-918 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N

References

https://github.com/MagicMirrorOrg/MagicMirror/security/advisories/GHSA-998g-7v5w-cr7g x_refsource_CONFIRM
https://github.com/MagicMirrorOrg/MagicMirror/pull/4169 x_refsource_MISC
https://github.com/MagicMirrorOrg/MagicMirror/commit/58c2a5e675a7d367b64d72e1d35680d202ff5c9f x_refsource_MISC
https://github.com/MagicMirrorOrg/MagicMirror/releases/tag/v2.37.0 x_refsource_MISC