Saint React2Shell, Who Deserialized Grace

Patron of Server Components, frameworks that do everything for you, and frontend developers discovering they have a server.

Life

On 3 December 2025 the React team disclosed a flaw found by Lachlan Davidson in React Server Components: requests to Server Functions were deserialized without due care, and a single HTTP request was enough to run code on the server, without authentication. A perfect score, CVSS 10, with Next.js hit by extension because it ships its own copy of React. Real attacks began within hours.

Prayer

O Saint React2Shell, who turns a component into a shell with a single payload, let our servers deserialize only what they asked for. Amen.

How to celebrate

Celebrated by upgrading React and Next.js to the fixed versions, and wondering what else the framework does on the server side.

Render on the server, reap on the server.