CVE-2026-63642: MagicMirror² SSRF Vulnerability

CVE-2026-63642 Overview

CVE-2026-63642 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] in MagicMirror², an open source modular smart mirror platform. Versions prior to 2.37.0 expose the checkArticleUrl function in defaultmodules/newsfeed/node_helper.js through an unauthenticated Socket.IO namespace /newsfeed. The helper accepts a CHECK_ARTICLE_URL notification and issues fetch(url, { method: "HEAD" }) without validating the attacker-controlled URL. It then returns ARTICLE_URL_STATUS containing the URL and framing result, creating a response and timing oracle. The issue was fixed in version 2.37.0.

Critical Impact
Unauthenticated attackers can probe internal hosts and ports, and trigger side effects on services that react to HTTP HEAD requests.

Affected Products

MagicMirror² versions prior to 2.37.0
defaultmodules/newsfeed/node_helper.js component
Socket.IO /newsfeed namespace exposed by the MagicMirror server

Discovery Timeline

2026-08-18 - CVE-2026-63642 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-63642

Vulnerability Analysis

MagicMirror² exposes a Socket.IO server for module-to-server communication. The newsfeed default module registers a /newsfeed namespace that listens for the CHECK_ARTICLE_URL notification. When the notification arrives, checkArticleUrl in node_helper.js calls fetch(url, { method: "HEAD" }) against the supplied URL. The response status and framing result are returned to the client through an ARTICLE_URL_STATUS event.

Because the Socket.IO namespace was not bound to the existing ipWhitelist enforcement used for Express HTTP endpoints, remote clients could reach the handler directly. This exposure turns the newsfeed helper into an SSRF primitive usable against internal services reachable from the MagicMirror host.

Root Cause

The root cause is twofold: missing URL validation in checkArticleUrl, and missing IP-based access control on the Socket.IO transport. Server access control was enforced only by Express middleware, while Socket.IO connections bypassed the whitelist entirely.

Attack Vector

An unauthenticated network attacker connects to the MagicMirror Socket.IO endpoint, joins the /newsfeed namespace, and emits CHECK_ARTICLE_URL with a URL targeting internal infrastructure. The returned status code and response timing act as an oracle for host and port discovery on the internal network. HEAD requests to state-changing endpoints can also trigger side effects on services that treat HEAD as equivalent to GET.

javascript

// Security patch in js/ip_access_control.js
// fix(server): enforce ipWhitelist for Socket.IO too (#4169)
/**
 * Resolves a client IP for both Express and Socket.IO requests.
 * If the direct peer is loopback, trust the first X-Forwarded-For value (local reverse proxy case).
 * Otherwise ignore X-Forwarded-For to prevent spoofing.
 * @param {object} req - Incoming request object (Express request or Socket.IO handshake request)
 * @returns {string} The resolved client IP address
 */
function resolveClientIp (req) {
	const directIp = req.socket?.remoteAddress || req.connection?.remoteAddress || req.ip;
	const LOOPBACK_WHITELIST = ["127.0.0.1", "::ffff:127.0.0.1", "::1"];

	if (isAllowed(directIp, LOOPBACK_WHITELIST)) {
		const forwardedFor = req.headers?.["x-forwarded-for"];
		if (typeof forwardedFor === "string" && forwardedFor.trim().length > 0) {
			return forwardedFor.split(",")[0].trim();
		}
	}

	return directIp;
}

Source: GitHub Commit 58c2a5e

The patch introduces resolveClientIp and a new socketIpAccessControl helper that applies the same whitelist to Socket.IO handshakes as the Express middleware, closing the unauthenticated path to checkArticleUrl.

Detection Methods for CVE-2026-63642

Indicators of Compromise

Inbound Socket.IO handshakes to the /newsfeed namespace from IP addresses outside the configured ipWhitelist.
Outbound HEAD requests from the MagicMirror host to internal RFC1918 addresses, localhost, or cloud metadata endpoints such as 169.254.169.254.
Repeated CHECK_ARTICLE_URL events with rotating hostnames or ports characteristic of port scanning.

Detection Strategies

Enable verbose logging on the MagicMirror node process and alert on ARTICLE_URL_STATUS responses referencing internal address ranges.
Deploy a host-based network monitor to flag unexpected egress from the MagicMirror server, since a smart mirror should only reach a small set of feed hosts.
Correlate Socket.IO connection source IPs with the configured whitelist and alert on mismatches.

Monitoring Recommendations

Inventory MagicMirror² deployments and record their versions to identify installs below 2.37.0.
Monitor for outbound connections to the cloud metadata service and to management interfaces on adjacent hosts.
Track process-level network activity from node processes running MagicMirror to detect anomalous fetch destinations.

How to Mitigate CVE-2026-63642

Immediate Actions Required

Upgrade MagicMirror² to version 2.37.0 or later, which enforces ipWhitelist on Socket.IO connections.
Restrict network exposure of the MagicMirror port so only trusted clients on the local network can reach it.
Review config.js and ensure ipWhitelist is populated with the minimal set of allowed clients rather than left empty.

Patch Information

The fix is delivered in MagicMirror² v2.37.0 via Pull Request #4169 and commit 58c2a5e. See the GitHub Security Advisory GHSA-998g-7v5w-cr7g for full advisory details.

Workarounds

Bind the MagicMirror server to 127.0.0.1 and access it only from the local device until the upgrade is applied.
Place the MagicMirror host behind a reverse proxy or firewall rule that blocks WebSocket traffic from untrusted networks.
Disable the default newsfeed module if the smart mirror does not require external feed status checks.

bash

# Configuration example - restrict access via config.js ipWhitelist
# /home/pi/MagicMirror/config/config.js
module.exports = {
    address: "127.0.0.1",
    port: 8080,
    ipWhitelist: ["127.0.0.1", "::ffff:127.0.0.1", "::1"],
    useHttps: false
};