MagicMirror newsfeed Socket.IO notification allows blind server-side request forgery

Description

Analysis of the PoC exploit-ssrf-newsfeed.js. Target: newsfeed/node_helper.js of MagicMirror², socket.io namespace /newsfeed.

Recommendation

Update the magicmirror package to the latest compatible version. Followings are version details:

Affected version(s): < 2.37.0
Patched version(s): 2.37.0

References

GHSA-998g-7v5w-cr7g
CVE-2026-63642
CWE-918
CAPEC-310

Could your website be exposed too?

SmartScanner can check your website for MagicMirror newsfeed Socket.IO notification allows blind server-side request forgery and gives you actionable findings to investigate.

Start a free scan

Related Issues

@better-auth/sso provider registration has server-side request forgery via unvalidated OIDC endpoints - CVE-2026-53513
HAX open-apis: Credential Theft via Server-Side Request Forgery (SSRF) in open-apis - CVE-2026-46391
LangSmith Client SDK Affected by Server-Side Request Forgery via Tracing Header Injection - CVE-2026-25528
pdfmake is vulnerable to server-side request forgery (SSRF) - CVE-2026-26801

Exploiting Server Version Disclosure

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

See something that needs correcting? Let us knowUpdated August 18, 2026