npm/magicmirror CVE-2026-63641: low, EPSS 0.43%

MagicMirror Socket.IO module namespaces bypass configured IP whitelist and allow unauthenticated server-side actions

Action: Upgrade magicmirror to 2.37.0 or later.

npm i magicmirror@2.37.0

Affected

Fixed versions

Sources

• osv: GHSA-w26r-fwg8-rcp3
• https://github.com/MagicMirrorOrg/MagicMirror/security/advisories/GHSA-w26r-fwg8-rcp3
• https://github.com/MagicMirrorOrg/MagicMirror/pull/4169
• https://github.com/MagicMirrorOrg/MagicMirror/commit/58c2a5e675a7d367b64d72e1d35680d202ff5c9f
• https://github.com/MagicMirrorOrg/MagicMirror
• https://github.com/MagicMirrorOrg/MagicMirror/releases/tag/v2.37.0

CVE-2026-63641 · published 2026-08-18T17:26:41Z · modified 2026-08-18T17:41:04.600125Z · JSON