CVE-2026-63642: CWE-918: Server-Side Request Forgery (SSRF) in MagicMirrorOrg MagicMirror
MagicMirror² versions prior to 2.37.0 contain a Server-Side Request Forgery (SSRF) vulnerability in the newsfeed module. The vulnerability arises because the checkArticleUrl function accepts URLs via an unauthenticated Socket.IO namespace and performs HTTP HEAD requests without validating the URL. This allows attackers to probe internal hosts and ports and potentially trigger side effects on services responding to HEAD requests. The issue is resolved in version 2.37.0.
AI Analysis
Technical Summary
CVE-2026-63642 is a Server-Side Request Forgery (SSRF) vulnerability in MagicMirror²'s defaultmodules/newsfeed/node_helper.js prior to version 2.37.0. The function checkArticleUrl accepts the CHECK_ARTICLE_URL notification through an unauthenticated Socket.IO namespace (/newsfeed) and performs fetch(url, { method: "HEAD" }) without validating the attacker-controlled URL. This behavior enables an attacker to use the helper's ARTICLE_URL_STATUS response as an oracle to identify internal hosts and ports and cause side effects on services that respond to HEAD requests. The vulnerability is fixed in MagicMirror² version 2.37.0.
Potential Impact
An unauthenticated attacker can send arbitrary URLs to the vulnerable function, causing the server to make HTTP HEAD requests to internal or external systems. This can be used to discover internal network topology and services, and potentially trigger side effects on those services. The vulnerability does not require user interaction or privileges. There are no known exploits in the wild as of the publication date.
Mitigation Recommendations
Upgrade MagicMirror² to version 2.37.0 or later, where the vulnerability is fixed. No other mitigation steps are indicated by the vendor advisory.
CVE-2026-63642: CWE-918: Server-Side Request Forgery (SSRF) in MagicMirrorOrg MagicMirror
Description
MagicMirror² versions prior to 2.37.0 contain a Server-Side Request Forgery (SSRF) vulnerability in the newsfeed module. The vulnerability arises because the checkArticleUrl function accepts URLs via an unauthenticated Socket.IO namespace and performs HTTP HEAD requests without validating the URL. This allows attackers to probe internal hosts and ports and potentially trigger side effects on services responding to HEAD requests. The issue is resolved in version 2.37.0.
CVSS v4.0
Score 6.3medium
Affected software
MagicMirrorOrg
MagicMirror
pkg:github/magicmirrororg/MagicMirrorRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-63642 is a Server-Side Request Forgery (SSRF) vulnerability in MagicMirror²'s defaultmodules/newsfeed/node_helper.js prior to version 2.37.0. The function checkArticleUrl accepts the CHECK_ARTICLE_URL notification through an unauthenticated Socket.IO namespace (/newsfeed) and performs fetch(url, { method: "HEAD" }) without validating the attacker-controlled URL. This behavior enables an attacker to use the helper's ARTICLE_URL_STATUS response as an oracle to identify internal hosts and ports and cause side effects on services that respond to HEAD requests. The vulnerability is fixed in MagicMirror² version 2.37.0.
Potential Impact
An unauthenticated attacker can send arbitrary URLs to the vulnerable function, causing the server to make HTTP HEAD requests to internal or external systems. This can be used to discover internal network topology and services, and potentially trigger side effects on those services. The vulnerability does not require user interaction or privileges. There are no known exploits in the wild as of the publication date.
Mitigation Recommendations
Upgrade MagicMirror² to version 2.37.0 or later, where the vulnerability is fixed. No other mitigation steps are indicated by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-07-17T14:11:15.483Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a84980ec6e8be0332896e11
Added to database: 08/18/2026, 17:36:14 UTC
Last enriched: 09/11/2026, 21:17:57 UTC
Last updated: 10/02/2026, 02:46:05 UTC
Views: 79
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.