React Server Components Security

5 posts · Jan 2021 – Dec 2025

What this trail covers

Vercel has enhanced its security posture against React Server Components vulnerabilities like React2Shell. This includes significant updates to the Seawall WAF, incorporating over 20 unique bypass techniques discovered through a $1 million bug bounty program, and the implementation of a defense-in-depth strategy with a compute-layer runtime mitigation. This mitigation directly prevents code execution via the `constructor` property during React rendering, covering 96% of Vercel traffic. The WAF w

All Vercel trails

Dec 2025Our $1 million hacker challenge for React2ShellThis post details Vercel's response to the React2Shell vulnerability (CVE-2025-55182), which allowed for remote code execution via vulnerable React Server Components. Vercel implemented a multi-layered defense strategy: 1. A $1 million bug bounty program with HackerOne to identify WAF bypasses, leading to 20 unique WAF updates and the permanent integration of 38 discovered bypass techniques into the Seawall WAF. 2. A compute-layer runtime mitigation that directly prevents code evaluation via the `constructor` property, covering 96% of Vercel traffic. The post highlights specific bypass techniques like recursive UTF-encoding and the exploitation of `ReadableStream` error messages, and Vercel's adaptation of Deno's runtime mitigation for Node.js.
Dec 2025React2Shell Security Bulletin | Vercel Knowledge BaseThis bulletin details the React2Shell vulnerability (CVE-2025-55182) affecting React Server Components and frameworks like Next.js. It outlines required actions for users, including immediate upgrades to patched versions of Next.js (15.0.0 through 16.0.6) and other frameworks using RSC. It also details Vercel's security actions, including WAF rules, automated upgrades via Vercel Agent, command-line utilities (`npx fix-react2shell-next`), manual upgrade steps, and recommendations for rotating environment variables. Deployment protection is strongly recommended for all deployments besides production domains.
Sep 2024What’s new in React 19This post introduces React 19 and its key features: Server Components, new directives ('use client', 'use server'), Actions (including Server Actions), and new hooks (`useActionState`, `useFormStatus`). It explains how Server Components improve performance by rendering on the server, reducing JavaScript bundles, and enabling data fetching before rendering. The post also details the role of directives in managing client-side vs. server-side code and demonstrates how Actions simplify form submissions and asynchronous operations. The integration of these features with Vercel's platform for deploying React applications is implied.
Aug 2023Understanding React Server ComponentsThis post introduces React Server Components (RSCs) as a paradigm shift in React development, moving data fetching and rendering to the server. It explains the historical context leading to RSCs, highlighting the limitations of traditional SSR and Suspense. RSCs are presented as a solution to improve performance and reduce client-side JavaScript bundle size by resolving dependencies and rendering on the server. The post details how RSCs interleave with Client Components and integrate with Suspense for faster rendering. It also discusses limitations, such as the inability to use lifecycle hooks in RSCs and the need for Client Components for interactivity and continuous updates. The integration with Next.js App Router is highlighted, where components are Server Components by default. The post also touches upon Server Actions as a mechanism for client-to-server mutability.
Jan 2021React Server Components with Next.jsThis post introduces React Server Components and their integration with Next.js, focusing on how they improve performance by reducing client-side JavaScript bundles and enabling better server infrastructure utilization. It contrasts Server Components with traditional Server-Side Rendering (SSR) and outlines how Next.js's `app` directory will leverage Server Components by default for pages and layouts, while allowing for explicit definition of client components. The post highlights the ability to use both component types within the same route.
Advertisement