Description
When hideConfigSecrets: true is enabled, MagicMirror redacts SECRET_* environment placeholders in the HTTP /config response, but the shared node-helper socket dispatcher expands **SECRET_NAME** placeholders in every inbound socket payload before passing it to module helpers.
Recommendation
Update the magicmirror package to the latest compatible version. Followings are version details:
- Affected version(s): < 2.37.0
- Patched version(s): 2.37.0
References
Could your website be exposed too?
SmartScanner can check your website for MagicMirror socket payload secret placeholder expansion can disclose SECRET_* environment variables and gives you actionable findings to investigate.
Start a free scanRelated Issues
- MagicMirror Socket.IO module namespaces bypass configured IP whitelist and allow unauthenticated server-side actions - CVE-2026-63641
- MagicMirror newsfeed Socket.IO notification allows blind server-side request forgery - CVE-2026-63642
- Payload: Polymorphic join queries could disclose hidden fields - CVE-2026-105847
- Inngest TypeScript SDK exposes environment variables via serve() handler on unhandled HTTP methods - CVE-2026-42047
You might also like:
See something that needs correcting? Let us knowUpdated August 18, 2026