Skip to main content
cve.nowby Sazabi
← npm
npmPackage

magicmirror

5 known vulnerabilities (1 critical, 3 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
2.38.0 (Oct 1, 2026): no advisory affects it
Newest unaffected release
2.38.0 (Oct 1, 2026), the latest release
Advisories
5 · 1 critical, 3 medium, 1 low
Weekly downloads
146
Dependents
0
Releases
11 since 2.0.0 (Mar 30, 2016)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 5

  • CVE-2026-63640Medium 4.3

    MagicMirror socket payload secret placeholder expansion can disclose SECRET_ environment variables

    Affected: fixed in 2.37.0.

    Fixed in 2.37.0 (released Jul 1, 2026, 48 days before disclosure).

    The latest release, 2.38.0, is not affected.

    49% of magicmirror downloads last week were affected versions (65).

  • CVE-2026-63642Medium 6.3

    MagicMirror newsfeed Socket.IO notification allows blind server-side request forgery

    Affected: fixed in 2.37.0.

    Fixed in 2.37.0 (released Jul 1, 2026, 48 days before disclosure).

    The latest release, 2.38.0, is not affected.

    49% of magicmirror downloads last week were affected versions (65).

  • CVE-2026-63643Medium 6.3

    MagicMirror: ssrf calendar .js

    Affected: fixed in 2.37.0.

    Fixed in 2.37.0 (released Jul 1, 2026, 48 days before disclosure).

    The latest release, 2.38.0, is not affected.

    49% of magicmirror downloads last week were affected versions (65).

  • MagicMirror Socket.IO module namespaces bypass configured IP whitelist and allow unauthenticated server-side actions

    Affected: fixed in 2.37.0.

    Fixed in 2.37.0 (released Jul 1, 2026, 48 days before disclosure).

    The latest release, 2.38.0, is not affected.

    49% of magicmirror downloads last week were affected versions (65).

  • CVE-2026-42281Critical 9.2

    MagicMirror²: Unauthenticated SSRF via /cors endpoint

    Affected: fixed in 2.36.0.

    Fixed in 2.36.0 (released Apr 30, 2026, 14 days before disclosure).

    The latest release, 2.38.0, is not affected.

    37% of magicmirror downloads last week were affected versions (50).