CVE-2026-63642 MagicMirrorOrg CVE debrief

Who should care

Defenders responsible for MagicMirror² installations, especially those exposed to external networks, should assess their exposure and ensure timely remediation. This includes verifying the MagicMirror² version, prioritizing remediation for externally accessible installations, and monitoring for unusual activity. Security teams and vulnerability management teams should also be aware of the potential impacts and ensure appropriate measures are taken.

Why it matters

CVE-2026-63642 in MagicMirror² allows unauthenticated attackers to potentially identify internal hosts and ports and trigger side effects. Defenders should verify exposure, prioritize remediation for externally accessible installations, and monitor for unusual activity.

• Potential identification of internal hosts and ports through timing oracle effects.
• Possible triggering of side effects on services reacting to HEAD requests.
• Verification of MagicMirror² version and exposure to external networks required.
• Remediation priority for installations with externally accessible /newsfeed namespaces.

Technical summary

The checkArticleUrl function in defaultmodules/newsfeed/node_helper.js of MagicMirror² accepts the CHECK_ARTICLE_URL notification through the unauthenticated Socket.IO namespace /newsfeed. It performs a HEAD request to an attacker-controlled URL without validation, potentially allowing attackers to identify internal hosts and ports and trigger side effects on services that react to HEAD requests. This issue is fixed in version 2.37.0. Defenders should prioritize verifying exposure of MagicMirror² installations, especially those with externally accessible /newsfeed namespaces, and ensure they are running version 2.37.0 or later.

Defensive priority

Defenders should prioritize verifying exposure of MagicMirror² installations, especially those with externally accessible /newsfeed namespaces, and ensure they are running version 2.37.0 or later.

Recommended defensive actions

• Verify MagicMirror² installations for exposure, especially those with externally accessible /newsfeed namespaces.
• Ensure MagicMirror² installations are running version 2.37.0 or later.
• Monitor for unusual activity related to HEAD requests in network logs.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and references to source repositories and commits. Defenders should verify the MagicMirror² version, assess exposure, especially for externally accessible /newsfeed namespaces, and monitor for unusual activity related to HEAD requests. The lack of input validation in the checkArticleUrl function allows attackers to potentially identify internal hosts and ports and trigger side effects on services that react to HEAD requests.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.