MagicMirror², an open source modular smart mirror platform, has an SSRF vulnerability identified as CVE-2026-63642. In versions before 2.37.0, the checkArticleUrl function in defaultmodules/newsfeed/node_helper.js accepts the CHECK_ARTICLE_URL notification through the unauthenticated Socket.IO namespace /newsfeed. It performs a fetch with the HTTP HEAD method on the attacker-controlled URL without validation. The helper returns ARTICLE_URL_STATUS containing the URL and framing result, which can be used as a timing oracle to identify internal hosts and ports and cause side effects on services that react to HEAD requests. This vulnerability is fixed in version 2.37.0.

An unauthenticated attacker can send requests to internal or external URLs via the vulnerable function, potentially discovering internal network information and triggering side effects on services that respond to HEAD requests. This can lead to information disclosure and indirect interaction with internal services. There is no indication of direct remote code execution or data compromise beyond SSRF effects.

Upgrade MagicMirror² to version 2.37.0 or later, where this SSRF vulnerability is fixed. No other mitigation is indicated or required according to the available data.