On December 3, 2025, coordinated disclosures revealed that multiple releases of React 19 and Next.js contain a critical flaw in the React Server Components (RSC) "Flight" protocol, allowing unauthenticated remote code execution (RCE). The vulnerability originates from unsafe deserialization of attacker-controlled data in server-side RSC payload handling.
Exploitation only requires a crafted HTTP request, works reliably in default configurations, and affects not only React/Next.js, but also any framework or bundler embedding the RSC implementation.
Patches are available and should be applied immediately. Systems running unpatched versions are exposed to full server compromise.
React 19 introduced a mechanism to split UI rendering between the client and the server, serializing component state and server function calls via a special transport format often referred to as the "Flight" protocol.
Affected packages include:
These packages deserialize incoming RSC payloads to route server-side operations. The vulnerability stems from the fact that the deserialization logic did not adequately enforce structural or type constraints, enabling malicious payloads to alter execution behavior.
Most frameworks that adopt RSC -- including Next.js App Router -- ship with this logic enabled out of the box. This means that a standard Next.js project created via create-next-app, built and deployed with no code modifications...was exploitable under default settings.
Note: No exploitation in the wild has been publicly confirmed as of disclosure, but exploitation requires minimal sophistication.
Research estimates show ~39% of cloud environments scanned had workloads running vulnerable versions of React/Next.js RSC.
At the core, the server-side RSC engine accepts a serialized "Flight" payload describing:
The vulnerable implementations trusted the inbound structure too deeply. When malformed but syntactically valid payloads were submitted, the server:
This leads directly to remote code execution prior to authentication, which is why the CVSS score is 10.0 (critical).
Vercel-hosted apps benefit from platform-level request filtering, but still require upgrades.
Ensure CI/CD pipelines rebuild Docker images or serverless bundles with the patched dependency graph.
If using Redwood, Waku, experimental RSC previews, or bundlers, verify:
This incident underscores a systemic challenge in modern JavaScript ecosystems: highly dynamic serialization mechanisms can become powerful RCE vectors when insufficient validation is applied. Because React Server Components are rapidly becoming foundational across frameworks, the blast radius of this vulnerability is unusually wide.
Patching this incident is straightforward, but delays dramatically increase risk. Organizations should upgrade now, verify dependent frameworks, and continue monitoring for further updates as ecosystem investigations progress.
Don't delay your fix. Review the Snyk advisories now to confirm affected versions and get full remediation details: