CRITICAL SECURITY VULNERABILITY IN REACT SERVER COMPONENTS

Summary from the TLDR newsletter

There is a security vulnerability in React Server Components that allows unauthenticated remote code execution. It exploits a flaw in how React decodes payloads sent to React Server Function endpoints. Apps may still be vulnerable even if they don't implement any React Server Function endpoints. The vulnerability is present in versions 19.0, 19.1.0, 19.1.1, and 19.2.0 of react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack.