Is CVE-2026-63642 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-63642 being exploited in the wild.

How severe is CVE-2026-63642?

Medium severity, with a CVSS score of 4, published 18 August 2026.

Which products and versions are affected?

MagicMirrorOrg MagicMirror² < 2.37.0; magicmirror (npm) SEMVER:introduced=0,fixed=2.37.0.

Is there a fix for CVE-2026-63642?

Yes. magicmirror (npm): upgrade to 2.37.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-63642 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-63642?

Check whether you run MagicMirrorOrg MagicMirror² or magicmirror (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-63642: MagicMirror newsfeed server-side request forgery in CHECK_ARTICLE_URL

Q: Is there a fix for CVE-2026-63642?

Yes. magicmirror (npm): upgrade to 2.37.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-63642 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-63642?

Check whether you run MagicMirrorOrg MagicMirror² or magicmirror (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-63642 · Severity: medium · CVSS 4 · Published 2026-08-18

MagicMirror is a popular open-source smart mirror platform that displays news feeds and other information. The newsfeed module contains an unauthenticated Socket.IO endpoint that accepts arbitrary URLs and performs server-side HEAD requests without validation. An attacker on the network can exploit this to scan internal hosts and ports, potentially discovering and probing internal services on the private network behind the mirror.

Technologies: MagicMirrorOrg MagicMirror², magicmirror (npm). Vendors: MagicMirrorOrg, npm.

Quick answers

Is CVE-2026-63642 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-63642 being exploited in the wild.
How severe is CVE-2026-63642?: Medium severity, with a CVSS score of 4, published 18 August 2026.
Which products and versions are affected?: MagicMirrorOrg MagicMirror² < 2.37.0; magicmirror (npm) SEMVER:introduced=0,fixed=2.37.0.
Is there a fix for CVE-2026-63642?: Yes. magicmirror (npm): upgrade to 2.37.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-63642 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-63642?: Check whether you run MagicMirrorOrg MagicMirror² or magicmirror (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

magicmirror (npm): upgrade to 2.37.0 or later
```
npm install magicmirror@2.37.0
```

Technical details

The vulnerability exists in newsfeed/node_helper.js, where the checkArticleUrl() function performs fetch(url, { method: "HEAD" }) on attacker-supplied URLs without validation. The Socket.IO server is configured with permissive CORS (origin: /.*$/) and no authentication checks on the /newsfeed namespace, allowing any network-adjacent client to emit CHECK_ARTICLE_URL notifications. Although the server-side request uses HEAD (limiting body exposure), the combination of response timing, HTTP status codes, and error patterns provides a boolean oracle to determine whether internal hosts and services are alive. An attacker can systematically probe RFC1918 addresses and common service ports to map the internal network topology and discover running services. The vulnerability requires only network access to the mirror's HTTP port; no authentication is required. Patch: upgrade to version 2.37.0 or later, which validates URLs and restricts access to the endpoint.

Affected products

MagicMirrorOrg MagicMirror < 2.37.0

Identifiers

CVE-2026-63642
GHSA-998g-7v5w-cr7g

Timeline

2026-07-01: disclosed
2026-08-18: advisory
2026-08-18: patched: Version 2.37.0 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.