TL;DR

Explore the critical security vulnerabilities within the React Flight Protocol and learn how to protect your applications from deserialization attacks.

Key Takeaways
  • The React2Shell vulnerability allows remote code execution via improper deserialization handling.
  • Attackers can exploit RSC endpoints without authentication, posing a significant security risk.
  • Mitigation includes updating React packages and implementing strict input validation.
  • Awareness and proactive measures are crucial for securing RSCs against potential threats.

React Server Components (RSCs) have revolutionized the way interactive user interfaces are delivered, but with innovation comes the responsibility of addressing security vulnerabilities. The Flight protocol, while efficient, introduces deserialization sinks that can be weaponized, as highlighted by the React2Shell vulnerability.

Understanding the React2Shell Vulnerability

Disclosed in December 2025, the React2Shell vulnerability (CVE-2025-55182) is a critical flaw affecting React Server Components' reliance on the Flight protocol. This vulnerability, with a CVSS score of 10.0, highlights the dangers of improper deserialization handling, allowing attackers to execute arbitrary code on the server.

Impact on React Ecosystem

The flaw impacts npm packages such as react-server-dom-webpack, react-server-dom-turbopack, and react-server-dom-parcel in React versions 19.0.0 through 19.2.0. Developers using these packages are at risk of exploitation if they do not apply necessary patches.

The Mechanics of Exploitation

Attackers exploit this vulnerability by crafting malicious Flight payloads that, when deserialized by the server, lead to remote code execution. The lack of authentication requirements makes this vulnerability particularly dangerous, as it allows remote attackers to send HTTP requests to exposed RSC endpoints.

"A single malicious payload can compromise an entire server, emphasizing the urgency of robust security measures."
  • Crafting of malicious payloads.
  • Exploitation through HTTP requests.
  • Remote code execution without authentication.

Subsequent Vulnerabilities: A Pattern?

Following the React2Shell vulnerability, other deserialization issues emerged, such as CVE-2026-23864 and CVE-2026-23870. These flaws allow for Denial of Service (DoS) attacks through memory exhaustion and CPU consumption, exploiting weaknesses in the Flight protocol.

CVE-2026-23864: Memory Exhaustion

This vulnerability allows attackers to consume server resources, leading to DoS conditions. By sending cyclic or recursively referenced data structures, unauthenticated attackers can trigger CPU exhaustion, effectively taking down RSC endpoints.

CVE-2026-23870: CPU Consumption

Similarly, CVE-2026-23870 affects the Flight protocol by allowing attackers to send malicious structures that result in excessive CPU consumption, further emphasizing the need for robust deserialization safeguards.

Mitigation Measures: Protecting Your Applications

Addressing these vulnerabilities requires a proactive approach:

  1. Update React Packages: Ensure you're using the latest patched versions of React and related packages.
  2. Input Validation: Implement strict input validation and deserialization safeguards to prevent exploitation.
  3. Monitoring and Logging: Regularly monitor and log activities on RSC endpoints to detect unusual patterns early.

The Business Case for Rigorous Security

Investing in security not only protects your applications from vulnerabilities but also safeguards your reputation and user trust. By addressing deserialization vulnerabilities, businesses can ensure the integrity and reliability of their web applications, providing a secure user experience.

With these measures in place, your organization can confidently leverage the capabilities of React Server Components while minimizing security risks.

Frequently Asked Questions

What is the React2Shell vulnerability?

React2Shell (CVE-2025-55182) is a critical vulnerability in React Server Components that allows attackers to execute arbitrary code via improper deserialization handling.

How can attackers exploit deserialization sinks in RSCs?

Attackers can craft malicious payloads that, when deserialized by the server, lead to remote code execution without needing authentication.

What are some mitigation strategies for these vulnerabilities?

Updating React packages, implementing strict input validation, and monitoring RSC endpoints can help mitigate these vulnerabilities.

Sources