Top
Best
New

Posted by sangeeth96 12/11/2025

Denial of service and source code exposure in React Server Components(react.dev)
See also: https://blog.cloudflare.com/react2shell-rsc-vulnerabilities-..., https://nextjs.org/blog/security-update-2025-12-11
346 points | 225 commentspage 4
ginkgotree 12/11/2025|
I'm only surprised it took this long for an exposure of backend data to the front end to be discovered in RSC
aatd86 12/11/2025||
LOL. I must have divination powers. I am currently working on a UI framework and opened an issue just 3 weeks ago that says:

***

Seems that server functions are all the rage. We are unlikely to have them.

The main reason is that it ties the frontend and the backend together in undesirable ways.

It forces a js backend upon people (what if I want to use Go for instance).

The api is not client agnostic anymore. How to specify middleware is not clear.

Requires a bundler, so destroys isomorphism (isomorphic code requires no difference between the client and the server/ environment agnostic).

Even if it requires a bundler because it separates client and server implementation files, it blurs the data scoping (especially worrying for sensitive data) Do one thing and do it well: separate frontend and backend.

It might be something that is useful for people who only plan on having a javascript web frontend server separate from the API server that links to the backend service.

Besides, it is really not obvious to me how it becomes architecturally clearer. It would double the work in terms of security wrt authorization etc. This is at least not a generic pattern.

So I'd tend to go opposite to the trend and say no. Who knows, we might revisit it if anything changes in the future.

***

And boy, look at the future 3 weeks later...

To be fair, the one good thing is that they are hardening their implementation thanks to these discoveries. But still seems to me that this is wholly unnecessary and possibly will never be safe enough.

Anyway, not to toot my own horn, I know for a fact these things are difficult. Just found the timing funny. :)

brazukadev 12/11/2025|
I'm curious about your UI framework, is it public?
aatd86 12/11/2025||
Not public yet. Under review.
aabhay 12/12/2025||
“use insecure”
ashishb 12/11/2025||
The JavaScript fanatics will downvote me for saying this, but I'll say this, "using a single JavaScript codebase on your client-side and server-side is like cooking food in your toilet, sooner or later, contamination is guaranteed" [1]

1 - https://ashishb.net/tech/javascript/

leptons 12/11/2025||
This isn't a Javascript problem, this is a React problem. You could theoretically rewrite React and RSC in any language and the outcome would be the same. Say Python ran in the browser natively, and you reimplented React on browser and server in Python. Same problem, not Javascript.
ashishb 12/11/2025||
> This isn't a Javascript problem, this is a React problem.

It happened with Next.js as well https://github.com/vercel/next.js/discussions/11106

> Say Python ran in the browser natively, and you reimplented React on browser and server in Python. Same problem, not Javascript.

Yes.

And since Python does not natively run in the browser, that mistake never happens. With JavaScript, the desire to have "backend and frontend in a single codebase" requires active resistance.

rounce 12/12/2025|||
> It happened with Next.js as well

It's the same vulnerabilities because Next uses the vulnerable parts of React.

Your rational is quite poor as I can write an isomorphic web app in C or Rust or Go and run parts in the browser, what then? Look, many of us also strongly dislike JavaScript but generally that distaste is based on its actual shortcomings and failures, you don't have to invent new ones plenty already exist.

ashishb 12/12/2025||
> I can write an isomorphic web app in C or Rust or Go and run parts in the browser, what then?

If you have a single codebase for Go-based code running in an untrusted browser (the "toilet") and a trusted backend (the "kitchen"), then the same contamination is highly likely.

leptons 12/12/2025|||
>And since Python does not natively run in the browser, that mistake never happens.

Did you even bother to read my comment? Try again, please. Next time don't skip over parts.

pier25 12/12/2025|||
You can still have separate codebases for server and client in JS/TS...
ashishb 12/12/2025||
> You can still have separate codebases for server and client in JS/TS...

Indeed, but unlike Go/Python (backend) and TS/JS (frontend), the separation is surmountable, and the push to "reuse" is high.

pier25 12/13/2025||
> and the push to "reuse" is high

Other than types and stuff like zod validators there's not a lot of overlap between server and client code.

I agree with your point that iso code can be confusing. But beyond that I think you're just pushing an irrational anti JS narrative.

0xblinq 12/12/2025||
You're mixing programming languages with software architecture.
ashishb 12/12/2025||
> You're mixing programming languages with software architecture.

Programming languages do lead to certain software architectures. These are independent but not orthogonal issues.

carlcortright 12/11/2025||
dammit
andrewmcwatters 12/12/2025||
[dead]
phplovesong 12/12/2025||
SSR is just dumb. Its very rare that you would benefit much from this approach, the only thing you get an complexity bomb exploding in your face.

How about either just return html (maybe with htmx), or have a "now classic" SPA.

The frontend must be the most over engineered shitshow we as devs have ever created. Its where hype meets the metal.

tills13 12/12/2025||
Y'all are so pessimistic. React Server Components are great. React is a complex piece of software. Bugs happen.
ipnon 12/12/2025|
Personally I prefer simple software without bugs! This security vulnerability highlights a serious issue with React. It’s a SPA framework, a server side framework, and a functional component library all at the same time. And it’s apparently getting so complex that it’s introducing source code exposures.

I’m not interested in flame wars per se, but I can tell you there are better alternatives, and that the closer you stay towards targeting the browser itself the better, because browser APIs are at least an order of magnitude more secure and performant than equivalent JS operations.

rickhanlonii 12/11/2025|
After Log4Shell, additional CVEs were reported as well.

It’s common for critical CVEs to uncover follow‑up vulnerabilities because researchers scrutinize adjacent code paths looking for variant exploit techniques to test whether the initial mitigation can be bypassed.

PKop 12/11/2025||
The vulnerabilities existing is not a consequence of previous CVEs so this seems like an irrelevant non sequitur to keep mentioning everywhere.