CVE-2026-63642

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-63642
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63642.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-63642
Aliases
Published
2026-08-18T17:22:02Z
Modified
2026-10-28T02:30:45Z
Severity
  • 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N CVSS Calculator
Summary
MagicMirror newsfeed Socket.IO notification allows blind server-side request forgery
Details

MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, checkArticleUrl in defaultmodules/newsfeed/node_helper.js accepts the CHECK_ARTICLE_URL notification through the unauthenticated Socket.IO namespace /newsfeed and performs fetch(url, { method: "HEAD" }) without validating the attacker-controlled URL. The helper returns ARTICLE_URL_STATUS containing the URL and framing result, providing a response and timing oracle that can identify internal hosts and ports and trigger side effects on services that react to HEAD requests. This issue is fixed in version 2.37.0.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-918"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63642.json"
}
References

Affected packages

Git / github.com/magicmirrororg/magicmirror

Affected ranges

Type
GIT
Repo
https://github.com/magicmirrororg/magicmirror
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
4b4a59534f7da01e4030e46029fe9dd649a7675e
Fixed
58c2a5e675a7d367b64d72e1d35680d202ff5c9f
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "2.37.0"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "fixed": "58c2a5e675a7d367b64d72e1d35680d202ff5c9f"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "v2.37.0",
            "range": [
                {
                    "fixed": "4b4a59534f7da01e4030e46029fe9dd649a7675e"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

V2.*
V2.2.1
v.*
v.2.1.3
v2.*
v2.0.0
v2.0.1
v2.0.2
v2.0.3
v2.0.4
v2.0.5
v2.1.0
v2.1.1
v2.1.2
v2.1.3
v2.10.0
v2.10.1
v2.11.0
v2.12.0
v2.13.0
v2.14.0
v2.15.0
v2.16.0
v2.17.0
v2.17.1
v2.18.0
v2.19.0
v2.2.0
v2.2.1
v2.2.2
v2.20.0
v2.21.0
v2.22.0
v2.23.0
v2.24.0
v2.25.0
v2.26.0
v2.27.0
v2.28.0
v2.29.0
v2.3.0
v2.3.1
v2.30.0
v2.31.0
v2.32.0
v2.33.0
v2.34.0
v2.35.0
v2.36.0
v2.4.0
v2.4.1
v2.5.0
v2.6.0
v2.7.0
v2.7.1
v2.8.0
v2.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63642.json"