CVE-2026-72587: CoreBunch Instatic RCE Vulnerability

CVE-2026-72587 Overview

CVE-2026-72587 is a cache poisoning vulnerability affecting CoreBunch/Instatic versions through 0.0.14. An unauthenticated remote attacker can poison the shared process-wide render cache by manipulating the u query parameter of the GET /_instatic/hole/<nodeId> server island endpoint. The flaw is classified under [CWE-444] (Inconsistent Interpretation of HTTP Requests) and impacts the integrity of cached responses served to other users. Because the render cache is process-wide, poisoned content propagates to all clients requesting affected nodes until the cache is invalidated.

Critical Impact
Unauthenticated attackers can poison shared cache entries, potentially altering rendered output delivered to legitimate users of the server island endpoint.

Affected Products

CoreBunch Instatic through version 0.0.14
Applications embedding the affected _instatic/hole/<nodeId> server island endpoint
Deployments relying on the shared process-wide render cache

Discovery Timeline

2026-08-10 - CVE-2026-72587 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-72587

Vulnerability Analysis

The vulnerability resides in the server island endpoint GET /_instatic/hole/<nodeId>, which uses the u query parameter as part of cache key resolution or render input. Instatic fails to validate or normalize this parameter before storing rendered output in the shared render cache. An attacker sending crafted requests can force the server to store attacker-influenced content under keys later served to other users. Because the cache is shared across the entire process, any downstream client requesting the same node ID may receive the poisoned response.

Root Cause

The root cause is improper handling of the u query parameter during cache key computation and response storage. Instatic treats attacker-controlled input as part of trusted render context without sanitization. This mismatch between how requests are interpreted and how cached responses are keyed enables an inconsistent request interpretation condition tracked as [CWE-444].

Attack Vector

Exploitation requires only network access to the affected endpoint and user interaction to trigger the poisoned response, matching the network attack vector with low complexity. The attacker sends one or more crafted GET requests to /_instatic/hole/<nodeId> with a manipulated u parameter. The poisoned entry is then served to subsequent requesters. Refer to the CoreBunch/Instatic repository for endpoint implementation details.

No verified public exploit code is available for this issue. The vulnerability mechanism can be summarized as manipulating the u query parameter to influence cache key resolution and stored render output on the server island endpoint.

Detection Methods for CVE-2026-72587

Indicators of Compromise

Repeated GET /_instatic/hole/<nodeId> requests from a single source with varying or unusual u query parameter values.
Unexpected content variations returned from the same nodeId across different clients within short intervals.
Cache entries containing attacker-controlled strings or unexpected serialized values in the u parameter.

Detection Strategies

Log and inspect all requests to /_instatic/hole/ endpoints, focusing on the u parameter length, entropy, and character set.
Correlate response body hashes against the same nodeId to identify divergent cached outputs.
Alert on non-browser user agents issuing high request volumes to server island endpoints.

Monitoring Recommendations

Enable verbose access logging on the reverse proxy or application server fronting Instatic.
Monitor render cache hit rates and eviction patterns for anomalies consistent with poisoning attempts.
Track HTTP response integrity by comparing rendered output over time for stable node IDs.

How to Mitigate CVE-2026-72587

Immediate Actions Required

Upgrade CoreBunch/Instatic to a version later than 0.0.14 once a fixed release is published.
Restrict access to the /_instatic/hole/<nodeId> endpoint at the reverse proxy where feasible.
Flush the render cache after applying mitigations to remove any previously poisoned entries.

Patch Information

At the time of publication, no fixed release was listed in the NVD entry. Monitor the CoreBunch/Instatic repository for a patched version and associated commit references. Apply the update across all instances sharing the render cache to prevent reintroduction of poisoned entries.

Workarounds

Add strict input validation on the u query parameter at an upstream proxy, rejecting unexpected characters or lengths.
Disable the server island endpoint if the feature is not required by the deployment.
Segment the render cache per user or per session to eliminate the shared process-wide surface.

bash

# Example nginx rule to reject suspicious 'u' parameter values on the affected endpoint
location /_instatic/hole/ {
    if ($arg_u ~* "[^A-Za-z0-9_\-]") {
        return 400;
    }
    proxy_pass http://instatic_backend;
}