Source: Smashing Magazine
Introduction
React Server Components (RSCs) have fundamentally shifted how web applications function, moving beyond simple HTML or JSON to a sophisticated streaming protocol known as Flight. While developers often rely on the framework to manage this data flow, the underlying mechanics involve complex deserialization processes that carry significant security risks. Understanding how to weaponize and defend the React Flight protocol is no longer optional for teams building modern, secure digital infrastructure.
The discovery of critical vulnerabilities within this layer has forced a reevaluation of the trust placed in framework-level abstractions. By analyzing the deserialization sinks inherent in RSCs, security researchers have uncovered how attackers can exploit the very features designed to optimize component rendering. This analysis explores the technical reality of the Flight protocol and outlines essential strategies for hardening applications against potential exploitation.
What Happened
In December 2025, a critical security vulnerability designated as CVE-2025-55182 emerged, which the security community quickly labeled "React2Shell." This flaw represented a CVSS 10.0 vulnerability, allowing for unauthenticated remote code execution (RCE) through the Flight deserialization layer. By crafting a specific HTTP request targeting a Server Function endpoint, attackers could gain unauthorized shell access to the host environment without requiring credentials.
The Cybersecurity & Infrastructure Agency (CISA) subsequently added this vulnerability to its catalog of known exploited threats. Investigations by security firms like Sysdig linked active exploitation attempts to state-sponsored actors, who utilized the vulnerability to deploy file-less implants via the Ethereum blockchain. These incidents highlighted the severity of weaknesses within the protocol's reconstruction logic.
Background
The Flight protocol is a specialized, line-delimited format that instructs the client-side React runtime on how to reconstruct executable component trees. Unlike standard data formats, Flight transmits module references, server-side RPC endpoints, and lazy-loaded component definitions. This architecture essentially functions as a deserialization system, where the incoming stream directly influences the execution path of the client.
The core of this system relies on a prefix-based resolution method, where characters like $ trigger specific parsing behaviors. While these mechanisms enable powerful features like server-driven UI, they also create an extensive attack surface. When the parser encounters specific prefixes, it performs operations such as property traversal or function invocation, which can be manipulated if the input stream is not rigorously validated.
Key Details
The security landscape surrounding React Server Components involves several distinct vulnerabilities and technical characteristics. The following table summarizes the primary security threats and protocol features identified in recent research.
| Vulnerability/Feature | Impact/Function |
|---|---|
| CVE-2025-55182 (React2Shell) | CVSS 10.0 RCE vulnerability in the deserialization layer. |
| CVE-2025-55184 | DoS via infinite recursion of nested Promises. |
| CVE-2025-67779 | Secondary DoS vulnerability via parsing edge cases. |
| CVE-2026-23864 | Memory exhaustion and DoS via unbounded buffering. |
| CVE-2025-55183 | Information disclosure of source code through stringification. |
| CVE-2026-27978 | CSRF bypass via misinterpretation of Origin: null. |
| $: Prefix | Enables arbitrary property traversal on deserialized objects. |
| $F Prefix | Represents callable Server Action RPC endpoints. |
Impact
The implications of these vulnerabilities are profound, particularly regarding the concept of "behavioral deserialization." Because the Flight protocol reconstructs code execution, module loading, and state management from incoming text, attackers who control the stream effectively dictate the behavior of the application runtime. This goes beyond simple data injection; it allows for the manipulation of internal framework plumbing.
In the wild, these flaws have been leveraged for sophisticated attacks, including the deployment of persistent backdoors like KSwapDoor and EtherRAT. These implants often blend into existing system processes or utilize decentralized networks for command-and-control communication, making them difficult to detect and remediate. The speed at which state-sponsored actors weaponized these vulnerabilities underscores the necessity of proactive security measures over reactive patching.
What Happens Next
While the React team has released patches addressing the most severe gadgets and DoS vectors, the fundamental architecture of the Flight protocol remains a subject of intense scrutiny. The industry is moving toward a requirement for stronger cryptographic validation of serialized payloads and more robust integrity checks for streaming data. Developers are advised to maintain strict input validation schemas for all Server Actions and to treat framework-level protections as a baseline rather than a complete security solution.
Moving forward, the focus will likely remain on auditing the complex chunk resolution paths within ReactFlightClient.js. As server-driven UI patterns continue to proliferate, the security community will continue to monitor for new gadget chains that might emerge from the protocol's inherent support for property traversal and dynamic module loading. Maintaining updated dependencies and implementing defense-in-depth strategies remain the primary methods for mitigating these ongoing structural risks.
