Weaponizing And Defending The React Flight Protocol: Deserialization Sinks In RSCs — Smashing Magazine

The emergence of React Server Components (RSC) marked a paradigm shift in web development, promising a seamless blend of server-side performance and client-side interactivity. However, this architectural evolution introduced a novel communication mechanism known as the Flight protocol, which has recently become the focus of intense security scrutiny. In late 2025, the discovery of CVE-2025-55182, colloquially termed React2Shell, exposed a critical deserialization vulnerability within the Flight protocol, carrying a maximum CVSS severity score of 10.0. This vulnerability allowed for unauthenticated remote code execution (RCE), enabling attackers to gain full shell access to servers via a single crafted HTTP request. The subsequent fallout has forced a re-evaluation of how modern frameworks handle the serialization of executable behavior and the inherent risks of trusting streaming data formats.

The Architecture of the Flight Protocol

To understand the React2Shell vulnerability, one must first examine the underlying mechanics of React Server Components. Unlike traditional web applications that transmit HTML or RESTful APIs that exchange JSON, RSCs utilize a custom, streaming, line-delimited format called Flight. When a server component renders, the server does not send a static document; instead, it streams a series of instructions that the client-side React runtime reassembles into a live component tree.

The Flight protocol operates with a unique type system and reference resolution logic. Each line in a Flight payload, identified by the Content-Type: text/x-component header, serves as a self-contained "row" consisting of a row ID, a tag, and a payload. Common tags include "J" for JSON trees representing virtual DOM nodes, "M" for module metadata, and "I" for import directives. This system allows the client to load modules, resolve cross-chunk pointers, and maintain server-rendered element contexts in real-time.

The complexity—and the vulnerability—lies in the Flight protocol’s prefix system. When the client-side parser encounters a string prefixed with a dollar sign ($), it triggers specific resolution paths. For instance, $F represents a callable Server Action (an RPC endpoint), while $: indicates property access, allowing the protocol to traverse into resolved chunks. This mechanism transforms Flight from a mere data format into a system capable of reconstructing executable behavior on the client and server.

Chronology of the React2Shell Crisis

The timeline of the React2Shell vulnerability reveals a rapid escalation from discovery to state-sponsored exploitation.

December 3, 2025: The React team officially disclosed CVE-2025-55182, identifying a critical flaw in the Flight deserialization layer. Security researchers quickly dubbed the flaw "React2Shell" due to the ease with which it could be weaponized for remote command execution.

December 4–10, 2025: Within hours of the disclosure, the federal Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog. Security firm Sysdig reported in-the-wild exploitation by North Korean state-sponsored threat actors. These groups were observed deploying "EtherRAT," a file-less implant that utilized the Ethereum blockchain for command-and-control (C2) communication, a technique known as "EtherHiding."

January 2026: As developers scrambled to patch, secondary vulnerabilities began to surface. These included CVE-2025-55184 and CVE-2025-67779, both of which were denial-of-service (DoS) vulnerabilities involving infinite recursion in the deserialization of nested Promises. Additionally, CVE-2026-23864 was identified as an out-of-memory (OOM) vector involving zipbomb-style decompression of request bodies.

February 2026: The broader React ecosystem reached a critical mass of patching, though many legacy systems remained exposed. The incident highlighted a significant bottleneck in the security of modern JavaScript frameworks: the reliance on complex, internal parsers that execute before application-level security middleware can intervene.

Technical Analysis: The Deserialization Sink

The core of the React2Shell vulnerability resided in the getOutlinedModel function within the ReactFlightReplyServer.js file. This function was responsible for resolving deep property paths provided by the $: reference system. The vulnerability was remarkably simple: the parser would split a reference string (e.g., $1:__proto__:constructor) by colons and walk the path segment by segment without performing a hasOwnProperty check.

In JavaScript, objects inherit properties through a prototype chain. By injecting strings like __proto__ or constructor into the Flight stream, an attacker could traverse from a standard JSON object up to the Object constructor and, eventually, the Function constructor. Because the Function constructor in JavaScript acts similarly to eval(), the ability to reach it and provide arguments effectively granted the attacker the ability to execute arbitrary code.

This pattern mirrors historical deserialization vulnerabilities in other languages, such as Java’s ObjectInputStream or Python’s pickle. The fundamental issue is the same: the system deserializes attacker-controlled input, invokes behavior during the reconstruction process, and subsequently loses control of the execution flow. In the case of Flight, the protocol was not just moving data; it was moving instructions on how to build and execute components, making it a high-value target for exploitation.

Threat Actor Activity and Implants

The sophistication of the attacks following the React2Shell disclosure underscored the high stakes of framework security. Sysdig’s analysis of the North Korean campaigns revealed the use of EtherRAT, which avoided traditional detection by hiding its C2 traffic within the Ethereum blockchain’s transaction data. Because a blockchain cannot be "taken down" in the traditional sense, the implant’s communication remained resilient.

Simultaneously, Palo Alto Networks’ Unit 42 documented the "KSwapDoor" backdoor. This malware masqueraded as the legitimate [kswapd1] Linux kernel process to avoid detection in process lists. KSwapDoor utilized RC4 encryption for internal strings and AES-256-CFB for its peer-to-peer (P2P) mesh network communications. These tools demonstrated that state-sponsored actors were prepared to immediately weaponize framework-level vulnerabilities to gain persistent access to high-value infrastructure.

Official Responses and Patching

The React development team responded with a series of targeted patches aimed at hardening the Flight protocol’s property traversal logic. The primary fix involved caching the original Object.prototype.hasOwnProperty method at module load time and using .call() to invoke it during deserialization. This ensured that even if an attacker attempted to shadow the hasOwnProperty method on a malicious object, the parser would still use the genuine, secure check.

The fix was integrated into several versions of React to accommodate different release tracks:

• React 19.0.1, 19.1.2, and 19.2.1: Addressed the initial RCE (CVE-2025-55182) and source code exposure (CVE-2025-55183).
• React 19.0.4+, 19.1.5+, and 19.2.4+: Addressed the subsequent DoS and OOM vulnerabilities (CVE-2025-67779 and CVE-2026-23864).

While the patches effectively closed the known gadget chains, security analysts noted that the underlying design of the Flight protocol—specifically its reliance on string-based property traversal—remains a complex area of the codebase that may harbor future edge cases.

Broader Implications and Defensive Strategies

The React2Shell incident has highlighted the necessity of a "defense-in-depth" approach for applications utilizing Server Components. Experts have ranked several defensive measures by their impact:

1. Strict Input Validation: The most critical defense is the implementation of schema validation (using libraries like Zod or Valibot) at the entry point of every Server Action. Validating the shape and type of data before it is processed by business logic prevents the deserializer from being used to access unauthorized object properties.
2. The server-only Package: To prevent the accidental leakage of sensitive server-side code to the client, developers are encouraged to use the server-only package. This ensures that any module containing database credentials or internal logic cannot be imported by a client-side component.
3. CSRF Hardening: Relying solely on framework defaults for Cross-Site Request Forgery (CSRF) protection has proven insufficient. The discovery of CVE-2026-27978, a CSRF bypass in Next.js involving the Origin: null header from sandboxed iframes, demonstrated the need for explicit CSRF tokens and strict cookie configurations (SameSite=Strict).
4. The Taint API: React’s experimental Taint API provides a development-time guardrail to prevent specific object references or values (like API keys) from being serialized into the Flight stream. While not a complete security boundary, it helps catch inadvertent data leaks during development.

Historical Context and Structural Risks

The vulnerabilities found in the Flight protocol are not an anomaly in the history of software development. Similar patterns were observed in the Google Web Toolkit (GWT), which eventually disabled binary serialization after researchers demonstrated arbitrary deserialization attacks. Likewise, Java Server Faces (JSF) and ASP.NET’s ViewState suffered from tampering issues when cryptographic signing was improperly implemented.

The recurring theme is the risk associated with custom wire formats that move rich, stateful data between a "trusted" server and an untrusted client. As frameworks continue to adopt server-driven UI patterns, the industry is moving toward a consensus that "trusting the server" is no longer a sufficient security primitive. Future iterations of these protocols may require cryptographic validation of serialized payloads, signed component trees, and mandatory content integrity checks on the streaming data itself.

In conclusion, while React Server Components offer significant performance benefits, the React2Shell vulnerability serves as a stark reminder of the structural risks inherent in complex deserialization systems. For organizations, the lesson is clear: staying on patched versions of frameworks is only the first step. True security in the era of server-driven UI requires a proactive approach to input validation, boundary enforcement, and a deep understanding of the protocols that power modern web applications.