CVE-2026-72587

CVE-2026-72587 in Instatic represents a cache poisoning vulnerability that should be understood as an architectural failure, not an input validation oversight. The 'u' query parameter on an unauthenticated endpoint influences a process-wide render cache — meaning a single poisoned entry corrupts output for every user of the application until the TTL expires. This isn't a bug; it's the predictable outcome of mixing untrusted input with shared global state. The core problem: developers treated the 'u' parameter as infrastructure or CMS configuration rather than user input, because it originated from a content management workflow rather than a direct request. This is a recurring misclassification in caching systems — the parameter looks like routing metadata, not user data, until an attacker treats it as the latter. The CVSS 6.1 rating is dangerous precisely because it validates this misinterpretation, framing the issue as a minor input problem rather than a fundamental threat model failure. Immediate actions: First, audit every endpoint that influences cache keys and apply input validation or canonicalization to any parameter originating outside your trust boundary — treat CMS-fed URLs as untrusted user input. Second, refactor the render cache to be content-addressable (hash the parsed content, not the request parameters) or implement request-scoped caching isolation. Third, add explicit comments on cache key construction paths documenting why user-controlled input must never influence shared cache state — this prevents the next developer from reintroducing the same pattern. Finally, implement cache invalidation testing in your CI pipeline to catch reintroduction. The deeper concern: this vulnerability likely reflects the project's foundational mental model, where the rendering system was designed as single-tenant without isolation boundaries. As island hydration patterns proliferate in modern CMS tooling, this class of vulnerability will repeat unless teams explicitly challenge the assumption that performance optimization trumps cache isolation.

Reviewed through automated stages and approved by a human before publication.