#react-server-components

#react-server-components

Two hacking groups with ties to China have been observed weaponizing the newly disclosed security flaw in React Server Components (RSC) within hours of it becoming public knowledge. The vulnerability in question is CVE-2025-55182 (CVSS score: 10.0), aka React2Shell, which allows unauthenticated remote code execution. It has been addressed in React versions 19.0.1, 19.1.2, and 19.2.1. According to a new report shared by Amazon Web Services (AWS), two China-linked threat actors known as Earth Lamia and Jackpot Panda have been observed attempting to exploit the maximum-severity security flaw.

The hype around the introduction of React Server Components (RSC) was undeniable. For the uninitiated, RSCs are a new way to build React apps that render components on the server, keeping code and data-fetching logic away from the client. The promise was appealing: a unified approach to server and client rendering, unmatched performance, and simpler data fetching, enough to convince many of us that this was the next best thing after cheese.

When I started researching, I found that there are solutions outside of Next.js, but they were either incomplete or tied to specific tools like Vite or esbuild. The more I dug, the more I realized that what we really have is a pattern without a proper implementation. It reminded me of Flux back in the day-a pattern that introduced new ideas but lacked clear direction on how those ideas should fit into existing applications.