THE REACT2SHELL STORY

Summary from the TLDR Dev newsletter

A security researcher describes finding React2Shell, a critical remote code execution flaw in React's undocumented “Flight” protocol used by Server Components and Next.js. Over a week, he and a collaborator discovered that the protocol's handling of complex objects and JavaScript “thenables” could be abused to hijack React's internals and chain function calls into arbitrary code execution. He reported it to Meta on November 30, and Meta confirmed it within roughly 17 hours and released a fix and advisory by December 3.