Description

A cache poisoning vulnerability in CoreBunch/Instatic through 0.0.14 allows an unauthenticated remote attacker to poison the shared process-wide render cache by manipulating the u query parameter of the GET /_instatic/hole/<nodeId> server island endpoint. The originating-page URL supplied in u seeds the route template frame used for rendering, and the result is stored in a shared cache keyed only on nodeId, enabling an attacker to inject a crafted route that causes all subsequent visitors to receive malformed or attacker-controlled fragment content.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-08-10T11:17:31.760Z",
  "pubdate": "2026-08-10T11:17:31.760Z",
  "executiveSummary": "A cache poisoning vulnerability exists in CoreBunch/Instatic through version 0.0.14, specifically residing within the server island endpoint located at GET /_instatic/hole/<nodeId>. This vulnerability allows an unauthenticated remote attacker to manipulate the process-wide render cache by tampering with the u query parameter. Because the rendering engine utilizes the originating-page URL supplied via the u parameter to seed the route template frame, and the resulting rendered fragment is stored in a shared cache keyed solely on the nodeId, attackers can successfully inject malicious route structures. Consequently, all subsequent unsuspecting visitors requesting the affected node receive malformed or entirely attacker-controlled fragment content, posing significant integrity and availability risks to the affected web application. The exploitation requires no prior authentication or specialized privileges, operating entirely over remote network vectors against exposed server-side rendering mechanisms.",
  "technicalDetails": "The vulnerability stems from flawed cache key generation and insecure input handling within the server island endpoint GET /_instatic/hole/<nodeId> of CoreBunch/Instatic versions through 0.0.14. The root cause is the reliance on user-supplied input from the u query parameter to construct the route template frame during server-side rendering, combined with a caching mechanism that keys stored entries exclusively on the nodeId rather than including the contextual u parameter value in the cache key.\nAn unauthenticated remote attacker initiates the attack flow by sending a crafted HTTP GET request to the vulnerable endpoint GET /_instatic/hole/<nodeId> with a maliciously manipulated u query parameter. The application processes this input, using the injected URL to seed the route template frame for rendering the server island. The resulting output, now containing the attacker-controlled or malformed content, is subsequently written to the shared process-wide render cache under the targeted nodeId key.\nOnce the cache is poisoned, any subsequent visitor or legitimate user requesting the same nodeId receives the cached, malicious fragment instead of the intended application content. This leads to widespread content corruption and potential cross-site scripting or UI redress depending on the nature of the injected template frame. The attack requires network exposure to the target application instance, involves zero authentication or privilege requirements, and heavily impacts the confidentiality, integrity, and availability of the rendered components."
}