Description
An unauthenticated Server-Side Request Forgery (SSRF) vulnerability in the /cors endpoint allows any remote attacker to force the MagicMirror² server to perform arbitrary HTTP requests to internal networks, cloud metadata services, and localhost services.
Recommendation
Update the magicmirror package to the latest compatible version. Followings are version details:
- Affected version(s): <= 2.35.0
- Patched version(s): 2.36.0
References
Related Issues
- Cloudflare has SSRF via redirect following through its image-binding-transform endpoint (incomplete fix for GHSA-qpr4) - CVE-2026-41321
- React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint - CVE-2026-42342
- Angular SSR is vulnerable to SSRF and Header Injection via request handling pipeline - CVE-2026-27739
- Sentry Next.js vulnerable to SSRF via Next.js SDK tunnel endpoint - CVE-2023-46729
You might also like:
- Tags:
- npm
- magicmirror
Anything's wrong? Let us know Last updated on June 08, 2026