CVE-2026-72587 — Instatic - Cache Poisoning via Unauthenticated Server Island Endpoint
A cache poisoning vulnerability in CoreBunch/Instatic through 0.0.14 allows an unauthenticated remote attacker to poison the shared process-wide render cache by manipulating the…
Published: 2026-08-10 · CVSS: 6.1 · CVSS 3.1
A cache poisoning vulnerability in CoreBunch/Instatic through 0.0.14 allows an unauthenticated remote attacker to poison the shared process-wide render cache by manipulating the u query parameter of the GET /_instatic/hole/<nodeId> server island endpoint.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7