React Server Components Security

12/19/2025

This post details the implementation of a defense-in-depth strategy to protect against React Server Components vulnerabilities, specifically React2Shell. It describes the development of a compute-layer runtime mitigation that prevents code execution by denying access to the `constructor` property during React rendering. This mitigation was validated at scale and shared with other platform providers. The post also elaborates on specific bypass techniques discovered through a bug bounty program, such as recursive UTF-encoding and exploiting JavaScript's ReadableStream class, and how these were addressed by hardening the Seawall WAF with recursive decoding and improved pattern matching.

12/5/2025

This post addresses critical security vulnerabilities in React Server Components, specifically React2Shell (CVE-2025-55182) and related DoS/source code disclosure issues (CVE-2025-55184, CVE-2025-55183). It provides detailed guidance on identifying affected versions of Next.js and React, outlines manual and automated upgrade methods using `npx fix-react2shell-next` and Vercel Agent, and emphasizes the importance of Vercel's deployment protection and secret rotation for mitigation.

9/4/2024

This post introduces React 19 and its key features: Server Components, new directives ('use client', 'use server'), Actions (including Server Actions), and new hooks (`useActionState`, `useFormStatus`). It explains how Server Components improve performance by rendering on the server, reducing JavaScript bundles, and enabling data fetching before rendering. The post also details the role of directives in managing client-side vs. server-side code and demonstrates how Actions simplify form submissions and asynchronous operations. The integration of these features with Vercel's platform for deploying React applications is implied.

8/1/2023

This post introduces React Server Components (RSCs) as a paradigm shift in React development, moving data fetching and rendering to the server. It explains the historical context leading to RSCs, highlighting the limitations of traditional SSR and Suspense. RSCs are presented as a solution to improve performance and reduce client-side JavaScript bundle size by resolving dependencies and rendering on the server. The post details how RSCs interleave with Client Components and integrate with Suspense for faster rendering. It also discusses limitations, such as the inability to use lifecycle hooks in RSCs and the need for Client Components for interactivity and continuous updates. The integration with Next.js App Router is highlighted, where components are Server Components by default. The post also touches upon Server Actions as a mechanism for client-to-server mutability.

1/15/2021

This post introduces React Server Components and their integration with Next.js, focusing on how they improve performance by reducing client-side JavaScript bundles and enabling better server infrastructure utilization. It contrasts Server Components with traditional Server-Side Rendering (SSR) and outlines how Next.js's `app` directory will leverage Server Components by default for pages and layouts, while allowing for explicit definition of client components. The post highlights the ability to use both component types within the same route.