React Server Components Have a CVSS 10.0 Problem You Should Know

A CVSS score of 10.0 is the security world’s way of saying “drop everything.” The React Flight protocol — the custom streaming mechanism that makes React Server Components work — just earned one.

Durgesh Pawar’s deep-dive on Smashing Magazine, published this week, dissects what’s being tracked as the “React2Shell” vulnerability: a deserialization flaw in RSCs that, under the right conditions, allows an attacker to achieve remote code execution. Not data exfiltration. Not a session hijack. Full shell access. If your team adopted RSCs because the DX story was compelling (and it is), now is the time to read the spec, not just the changelog.

What the Flight Protocol Actually Does — and Where It Breaks

React Server Components stream UI as a serialized tree from server to client using the Flight protocol — a custom binary-ish format that React’s runtime deserializes on the client side. The efficiency gains are real: smaller JavaScript bundles, server-side data fetching without waterfall round-trips, and better Time to First Byte on low-bandwidth connections common across Southeast Asian mobile networks.

The problem, as Pawar documents, is that the deserialization layer introduces sinks — points where attacker-controlled data can influence the execution path. If an attacker can manipulate the streamed Flight payload (through a compromised CDN node, a man-in-the-middle on an unencrypted endpoint, or a server-side injection upstream), the client runtime may execute arbitrary code during the hydration phase. The attack surface is particularly sharp in applications that pass unsanitized server data directly into RSC props.

Why Southeast Asian Deployments Carry Extra Exposure

This isn’t a theoretical risk that only matters in US enterprise environments. Several factors specific to the region amplify it.

First, CDN topology. Many brands running React frontends in Southeast Asia route traffic through regional PoPs that sit outside their primary infrastructure perimeter. A compromised edge node between a Jakarta origin and a Singaporean CDN PoP is exactly the kind of position an attacker needs to inject a malformed Flight payload.

Second, adoption curve. RSCs went mainstream fast — Next.js 13 and 14 pushed the App Router aggressively, and agencies shipped it into production without necessarily auditing the trust boundaries between server and client component trees. Smashing Magazine’s analysis notes that the critical path runs through how applications handle use client boundaries and whether data crossing those boundaries is validated server-side before serialization.

Third, mixed-origin data. Platforms integrating Shopee, Lazada, or Grab APIs into RSC data-fetching layers may be passing partially untrusted third-party response data through Flight without a sanitization step. That’s a direct path to exploitation.

---

What Your Team Should Audit This Week

Pawar’s breakdown implies a concrete checklist, even if the article stops short of prescribing one. Here’s what a stress-test of your RSC architecture should cover.

Validate at the boundary, not the component. Any data fetched server-side and passed as props to a Client Component should be validated and sanitized before it enters the serialization pipeline — not inside the component after deserialization. Schema validation libraries like Zod work here, but they need to sit at the fetch layer, not the render layer.

Audit use client propagation. In larger codebases, use client directives can propagate implicitly through component trees. Map which components are actually hydrated client-side and confirm that none of them receive unsanitized server state directly.

Review your CDN and transport security posture. If your React app is served over HTTP/2 without strict certificate pinning on API routes that feed RSC data, you have a potential injection vector. This is particularly relevant for apps deployed across multi-cloud setups common in the region — AWS Singapore + GCP Thailand, for instance.

Pin your React version and monitor the advisory feed. The React team has been responsive to security disclosures, but React2Shell illustrates that the framework’s cutting-edge features carry cutting-edge risk. Version pinning with a monitored upgrade path beats auto-updating into an unreviewed release.

The Broader Signal: Framework Abstraction Has a Security Cost

There’s a pattern worth naming here. The same architectural move that makes RSCs compelling — abstracting the server/client boundary so developers don’t have to think about it — is what creates the vulnerability. When the framework manages serialization transparently, developers stop thinking about what’s being serialized and where it came from.

This isn’t unique to React. The CSS writing-mode property, documented in detail this week on CSS-Tricks, is a reminder that even decades-old CSS specs carry implementation nuance that teams routinely ignore until it breaks something in production — particularly relevant for Southeast Asian brands building multilingual interfaces in Thai, Khmer, or traditional Chinese where vertical text rendering matters. The lesson across both is the same: framework convenience is a loan, not a gift. The spec always collects eventually.

Unseen Studio’s recent Codrops feature frames the craft of digital experience around “hidden stories” — which is an apt, if unintentional, metaphor for what the Flight protocol has been doing inside React apps. The story was always there in the serialization layer. Most teams just hadn’t read it yet.

The question worth sitting with: if your engineering team adopted RSCs primarily because the framework recommended them, do they have the protocol-level understanding to defend them? That gap between adoption and comprehension is where most production incidents begin.

---

At grzzly, we work with digital and engineering teams across Southeast Asia to stress-test exactly these kinds of framework assumptions — from JavaScript payload audits to tracking architecture reviews. If your team is running RSCs in production and hasn’t mapped the trust boundaries, that’s a conversation worth having sooner rather than later. Let’s talk