EUVD-2026-55219
GHSA-9p8f-ppfj-8gc5
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-accessible unauthenticated endpoint with no complexity barriers; scope change and UI:R reflect that poisoned cache harms other users, not the attacker directly.
Primary rating from Vendor (TuranSec).
CVSS VectorVendor: TuranSec
Lifecycle Timeline
2DescriptionCVE.org
A cache poisoning vulnerability in CoreBunch/Instatic through 0.0.14 allows an unauthenticated remote attacker to poison the shared process-wide render cache by manipulating the u query parameter of the GET /_instatic/hole/<nodeId> server island endpoint. The originating-page URL supplied in u seeds the route template frame used for rendering, and the result is stored in a shared cache keyed only on nodeId, enabling an attacker to inject a crafted route that causes all subsequent visitors to receive malformed or attacker-controlled fragment content.
AnalysisAI
Cache poisoning in CoreBunch/Instatic through version 0.0.14 allows unauthenticated remote attackers to corrupt the shared process-wide render cache by supplying a crafted originating-page URL via the u query parameter of the server island endpoint GET /_instatic/hole/<nodeId>. Because the cache is keyed solely on nodeId without incorporating the u value, a single poisoning request causes every subsequent visitor requesting that node to receive attacker-controlled fragment content. No public exploit code has been identified and no CISA KEV listing exists; the product's early-stage, niche deployment footprint limits real-world blast radius, but the unauthenticated network vector and low attack complexity make exploitation straightforward against exposed instances.
Technical ContextAI
Instatic (CPE: cpe:2.3:a:corebunch:instatic:*:*:*:*:*:*:*:*) is a server-side rendering library providing 'server island' functionality - independently-renderable page fragments served via a dedicated /_instatic/hole/<nodeId> HTTP endpoint. The u query parameter is intended to convey the originating-page URL so the rendering engine can resolve the correct route template frame for the island. The root cause (tagged CWE-444, Inconsistent Interpretation of HTTP Requests) manifests as a cache design flaw: the route template frame derived from the attacker-controlled u value is used to render the fragment, but the resulting output is stored in a shared, process-wide in-memory cache keyed only on nodeId. By providing a u value pointing to a crafted or attacker-controlled route, an adversary causes the server to render and cache a malicious fragment under the legitimate nodeId key. Subsequent requests for that node - from any user - are served the poisoned cached response. The tags 'Code Injection' and 'Request Smuggling' reflect that the injected u value effectively smuggles attacker-controlled routing context into the server's rendering pipeline.
RemediationAI
No confirmed patched version is present in the available intelligence - operators must verify current fix status directly at https://github.com/CoreBunch/Instatic and upgrade to any release newer than 0.0.14 that addresses cache key construction. As an immediate compensating control, restrict access to the /_instatic/hole/ path via reverse proxy or WAF rules to prevent unauthenticated external access; this eliminates the attack surface but may break legitimate server island functionality for external users. A second mitigation is to implement cache key normalization at the application or CDN layer to incorporate the full u parameter value in the cache key, preventing cross-user cache poisoning, though this requires code-level or infrastructure changes. Disabling the shared process-wide render cache entirely removes the vulnerability at the cost of increased server-side rendering latency on every request. Input validation restricting the u parameter to an allowlist of known application page URLs would constrain the attacker's ability to inject crafted routes but requires maintaining the allowlist as application routes change.
Same weakness CWE-444 – HTTP Request/Response Smuggling
View allSame technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today