CLAIM-2026-08-24-05
A distinct earlier Context7 flaw disclosed by Noma Security ('ContextCrush', same Custom Instructions surface, no CVE assigned) was discovered 18 February 2026, patched by Upstash 23 February 2026 and publicly disclosed 5 March 2026.
Why it matters
The same feature producing a second disclosure months later signals the injection surface, not a single bug, is the durable problem.
Sources
- nomasecurit2026contextcr