So a pretty wild new vulnerability class just dropped, and if you work with React, Node.js, Next.js, or anything modern web-related… you’ll probably want to know about it.
It’s called React2Shell basically a way for attackers to turn React Server Components into a remote code execution vector.
Yep… a UI-layer feature leading to backend RCE. 2026 is off to a great start 😂
Cloudflare already confirmed their internal systems had exposure to this class, and several researchers managed to weaponize it using React’s Flight serialization protocol.
The TL;DR:
-
React Server Components (RSC) use a special serialization format
-
Under certain conditions, attackers can send crafted multipart/form-data with weird fields
-
React ends up deserializing objects it should never trust
-
This escalates into Node.js Function constructor execution
-
Which means: full server-side command execution 🔥
The good news?
This attack requires a VERY specific request format , stuff no real user would ever generate. So blue teams actually have great detection opportunities.
I put together a full breakdown video covering:
✔ How the exploit chain works (in simple terms)
✔ What parts of React’s architecture make it possible
✔ How the PoC achieves code execution
✔ Indicators of compromise
✔ Snort + OSQuery rules you can use right now
✔ What to patch and how to harden RSC
0 comments