npm/magicmirror CVE-2026-63642: medium, EPSS 0.50%

MagicMirror newsfeed Socket.IO notification allows blind server-side request forgery

Action: Upgrade magicmirror to 2.37.0 or later.

npm i magicmirror@2.37.0

Affected

Fixed versions

Sources

• osv: GHSA-998g-7v5w-cr7g
• https://github.com/MagicMirrorOrg/MagicMirror/security/advisories/GHSA-998g-7v5w-cr7g
• https://github.com/MagicMirrorOrg/MagicMirror/pull/4169
• https://github.com/MagicMirrorOrg/MagicMirror/commit/58c2a5e675a7d367b64d72e1d35680d202ff5c9f
• https://github.com/MagicMirrorOrg/MagicMirror
• https://github.com/MagicMirrorOrg/MagicMirror/releases/tag/v2.37.0

CVE-2026-63642 · published 2026-08-18T17:26:46Z · modified 2026-08-18T17:41:04.517510Z · JSON