CVE-2026-72587 in Instatic
Summary
by MITRE • 08/10/2026
A cache poisoning vulnerability in CoreBunch/Instatic through 0.0.14 allows an unauthenticated remote attacker to poison the shared process-wide render cache by manipulating the u query parameter of the GET /_instatic/hole/<nodeId> server island endpoint. The originating-page URL supplied in u seeds the route template frame used for rendering, and the result is stored in a shared cache keyed only on nodeId, enabling an attacker to inject a crafted route that causes all subsequent visitors to receive malformed or attacker-controlled fragment content.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/10/2026
This vulnerability represents a critical cache poisoning flaw in the CoreBunch/Instatic framework version 0.0.14 and earlier, where unauthenticated remote attackers can manipulate the application's rendering process through deliberate input manipulation. The vulnerability specifically targets the GET /_instatic/hole/ endpoint which serves as a server island mechanism for dynamic content generation. When an attacker supplies a crafted URL through the u query parameter, this input directly influences how the route template frame is constructed during the rendering process. The system's caching mechanism operates on a shared process-wide cache structure that uses only the nodeId as its key identifier, creating a fundamental design flaw that allows attackers to inject malicious route templates into the cache.
The technical exploitation occurs through manipulation of the u parameter which serves as the originating-page URL that seeds the route template frame used for rendering. This creates a scenario where an attacker can craft specific input that gets processed and cached without proper validation or sanitization. The vulnerability stems from insufficient input validation and improper cache key design, allowing attackers to craft route templates that will be stored in the shared cache and subsequently served to all subsequent visitors. The attack vector specifically targets the server island architecture pattern where dynamic content is generated based on URL parameters, making it possible for an attacker to inject malicious fragments that will be rendered for every user accessing the affected endpoint.
The operational impact of this vulnerability extends beyond simple content manipulation as it creates a persistent backdoor for attackers to serve modified or malicious content to all users of the application. Since the cache is process-wide and keyed only by nodeId, any successful injection affects the entire application instance rather than being isolated to specific requests or users. This allows attackers to potentially deliver phishing content, malware delivery payloads, or other malicious fragments that can compromise user security and trust in the application. The vulnerability enables a form of persistent cross-site scripting attack where the injected content becomes part of the normal rendering pipeline for all subsequent visitors.
From a cybersecurity perspective, this vulnerability maps directly to CWE-94 (Improper Control of Generation of Code) and CWE-1021 (Improper Restriction of Rendered UI Layers or Components), as it involves improper control over code generation through user input manipulation. The attack pattern aligns with ATT&CK technique T1583.001 (Abuse of Functionality) where attackers exploit legitimate application features to achieve malicious objectives, and potentially T1496 (Resource Hijacking) if the injected content is used for malicious purposes. The vulnerability also demonstrates poor input validation practices that violate security principles outlined in OWASP Top Ten 2021 Category A03: Injection, as it allows untrusted data to influence code generation processes.
Mitigation strategies should focus on implementing proper input validation and sanitization for all user-supplied parameters before they are used in route template construction. The cache key design must be enhanced to include additional factors beyond just nodeId, such as the originating URL or request context, to prevent cross-contamination of cached content. Implementing proper parameter validation, using a more secure caching mechanism that validates input before caching, and employing Content Security Policy headers can help reduce the attack surface. Additionally, regular security audits should examine all server island endpoints for similar vulnerabilities, and implementing rate limiting or monitoring for unusual cache behavior can aid in detecting exploitation attempts. The system should also consider implementing proper session isolation or cache partitioning to prevent a single malicious input from affecting all users of the application.