CVE-2026-72587

Name of the Vulnerable Software and Affected Versions CoreBunch/Instatic versions 0.0.1 through 0.0.14

Description An unauthenticated remote attacker can poison the shared process-wide render cache. By manipulating the u query parameter of the GET '/ instatic/hole/' server island endpoint, an attacker can seed the route template frame used for rendering. Because the result is stored in a shared cache keyed only on nodeId, this allows the injection of a crafted route, causing subsequent visitors to receive malformed or attacker-controlled fragment content.

Recommendations Update CoreBunch/Instatic to a version later than 0.0.14. Avoid using the u parameter in the '/ instatic/hole/' endpoint until the software is updated.