CVE-2026-63642
Received Received - Intake

Server-Side Request Forgery in MagicMirror²

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: GitHub, Inc.

Description
MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, checkArticleUrl in defaultmodules/newsfeed/node_helper.js accepts the CHECK_ARTICLE_URL notification through the unauthenticated Socket.IO namespace /newsfeed and performs fetch(url, { method: "HEAD" }) without validating the attacker-controlled URL. The helper returns ARTICLE_URL_STATUS containing the URL and framing result, providing a response and timing oracle that can identify internal hosts and ports and trigger side effects on services that react to HEAD requests. This issue is fixed in version 2.37.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-08-18
AI Q&A
2026-08-18
EPSS Evaluated
N/A
NVD
CVE-2026-63642
EUVD
EUVD-2026-61072

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
magicmirror magicmirror to 2.37.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-63642 is a Server-Side Request Forgery (SSRF) vulnerability in MagicMirror² affecting versions before 2.37.0. The issue is in the newsfeed module where checkArticleUrl() performs a server-side HEAD request to a user-provided URL without validation. Attackers can exploit this by sending a CHECK_ARTICLE_URL notification via the unauthenticated /newsfeed Socket.IO namespace to send crafted requests to internal network services.

The vulnerability allows scanning internal hosts, detecting open ports, and triggering side effects on internal services even though response bodies are not visible. The flaw provides a response and timing oracle that can identify internal hosts and ports.

Detection Guidance

To detect this vulnerability, monitor network traffic for unauthorized Socket.IO connections to the /newsfeed namespace. Check for HEAD requests originating from MagicMirror to internal or external URLs. Use tools like tcpdump or Wireshark to capture traffic on ports used by MagicMirror. Inspect logs for CHECK_ARTICLE_URL notifications in unauthenticated namespaces.

Impact Analysis

This vulnerability allows attackers to scan your internal network, identify open ports and services, and potentially trigger unintended actions on internal systems by sending crafted HEAD requests. It could expose information about your internal network structure without requiring authentication.

While attackers cannot see response bodies, they can use timing differences and response codes to infer information about internal services, which could aid in further attacks or reconnaissance of your network.

Compliance Impact

This SSRF vulnerability could potentially violate compliance requirements that mandate network segmentation, access controls, and protection of internal systems. It may expose internal network information which could be considered a data breach under regulations like GDPR or HIPAA depending on what systems are discovered.

Mitigation Strategies

Upgrade MagicMirror to version 2.37.0 or later immediately. Disable the newsfeed module if not in use. Restrict network access to the Socket.IO /newsfeed namespace using firewalls or IP whitelisting. Monitor for unusual HEAD requests or Socket.IO activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63642. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart