MagicMirror newsfeed Socket.IO notification allows blind server-side request forgery
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.
Summary
MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, checkArticleUrl in defaultmodules/newsfeed/node_helper.js accepts the CHECK_ARTICLE_URL notification through the unauthenticated Socket.IO namespace /newsfeed and performs fetch(url, { method: "HEAD" }) without validating the attacker-controlled URL. The helper returns ARTICLE_URL_STATUS containing the URL and framing result, providing a response and timing oracle that can identify internal hosts and ports and trigger side effects on services that react to HEAD requests. This issue is fixed in version 2.37.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| MagicMirrorOrg | MagicMirror | before 2.37.0 | 2.37.0 | Patch available | CNA |
| — | magicmirror (npm) | before 2.37.0 | 2.37.0 | Patch available | GHSA-998g-7v5w-cr7g |
- MagicMirror VendorMagicMirrorOrg Affected before 2.37.0 Fixed in 2.37.0 Patch available CNA
- magicmirror (npm) Vendor— Affected before 2.37.0 Fixed in 2.37.0 Patch available GHSA-998g-7v5w-cr7g
Remediation
- Fix · CNA MagicMirror (MagicMirrorOrg) Fixed in 2.37.0
- Fix · GHSA-998g-7v5w-cr7g magicmirror (npm) Fixed in 2.37.0 Advisory →
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2026-63642
- 2026-10-03 Alias added: GHSA-998g-7v5w-cr7g
References
Other 5
- https://github.com/MagicMirrorOrg/MagicMirror/security/advisories/GHSA-998g-7v5w-cr7g
- https://github.com/MagicMirrorOrg/MagicMirror/pull/4169
- https://github.com/MagicMirrorOrg/MagicMirror/commit/58c2a5e675a7d367b64d72e1d35680d202ff5c9f
- https://github.com/MagicMirrorOrg/MagicMirror/releases/tag/v2.37.0
- https://github.com/MagicMirrorOrg/MagicMirror
More MagicMirrorOrg vulnerabilities
- TI-2026-45282 MagicMirror socket payload secret placeholder expansion can disclose SECRET_* environment variables CVSS 3.1MEDIUM 4.3
- TI-2026-45283 MagicMirror Socket.IO module namespaces bypass configured IP whitelist and allow unauthenticated server-side actions CVSS 4.0LOW 2.3
- TI-2026-45285 MagicMirror: ssrf calendar .js CVSS 4.0MEDIUM 6.3
Sources
- CVE-2026-63642 · CVE Program
- CVE-2026-63642 · NVD
- FIRST EPSS
- GHSA-998g-7v5w-cr7g · GitHub Advisory Database · CC BY 4.0
- CVE-2026-63642 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences