CVE-2026-72587
Received Received - Intake

Cache Poisoning in CoreBunch Instatic

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Description
A cache poisoning vulnerability in CoreBunch/Instatic through 0.0.14 allows an unauthenticated remote attacker to poison the shared process-wide render cache by manipulating the u query parameter of the GET /_instatic/hole/ server island endpoint.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-72587
EUVD
EUVD-2026-55219

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
corebunch instatic 0.0.14

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-444 The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a cache poisoning vulnerability in CoreBunch/Instatic through version 0.0.14. An unauthenticated remote attacker can manipulate the u query parameter in the GET /_instatic/hole/<nodeId> endpoint to poison the shared render cache. The attacker injects a crafted route via the u parameter, which seeds the route template frame used for rendering. The result is stored in a shared cache keyed only on nodeId, causing all subsequent visitors to receive malformed or attacker-controlled fragment content.

Detection Guidance

To detect this vulnerability, inspect HTTP requests to the /_instatic/hole/<nodeId> endpoint for unusual query parameters, particularly the 'u' parameter. Check server logs for repeated requests with manipulated 'u' values. Monitor render cache inconsistencies or unexpected content delivery.

Impact Analysis

This vulnerability allows an attacker to inject malicious or altered content into the cached responses served to all users visiting the site. This could lead to defacement, phishing attacks, or delivery of malicious scripts to visitors. Users may see incorrect or harmful content without the site owner realizing it, as the cache is shared and only keyed on nodeId.

Compliance Impact

This vulnerability could lead to data integrity issues and unauthorized content delivery, potentially violating GDPR's integrity principle or HIPAA's security requirements for protecting sensitive data. If malicious content is injected, it may expose users to phishing or malware, leading to breaches of confidentiality and compliance violations.

Mitigation Strategies

Immediately update Instatic to the latest version beyond 0.0.14 to patch the cache poisoning vulnerability. Disable the affected endpoint /_instatic/hole/<nodeId> if possible or restrict access to trusted users only. Monitor server responses for unexpected route template frames or malformed content.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72587. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart