Security Vulnerabilities and Defense Strategies in React Flight Protocol
Deserialization risks in React Server Components and mitigation approaches.
1Introduction to React Flight Protocol
React Server Components use a custom protocol called Flight instead of sending HTML or JSON to the browser. This protocol is designed to transfer component trees between server and client. However, most developers don't understand how this system actually works under the hood.
2Unique Structure of Flight
The Flight protocol consists of a mix of JSON fragments, dollar-sign prefixed references, and module pointers. This format is automatically processed by React runtime and transformed into a live component tree. This process involves data deserialization operations.
3React2Shell Vulnerability
CVE-2025-55182 (React2Shell), discovered in December 2025, was a critical security vulnerability in the Flight deserialization layer. This flaw allowed unauthenticated remote code execution and was exploited by North Korean state-sponsored actors targeting Ethereum blockchain applications.
4Deserialization Risks
React2Shell wasn't just a parsing bug - it was symptomatic of a fundamental issue in the Flight protocol. The protocol reconstructs executable references, components and RPC endpoints from text streams, making it inherently a deserialization system with all associated risks.
5Protocol Mechanics
Flight operates in a line-delimited format where each line contains an ID, tag and payload. Tags represent different data types like JSON trees, module references or server context. Dollar-prefixed references receive special processing during reconstruction.
6Reference Resolution System
Values starting with $ are processed specially - $F represents a Server Action, $L a lazy component, $@ the raw Chunk object. This resolution mechanism significantly expands the attack surface available to malicious actors.
7Attack Vectors
Attackers can manipulate Flight deserialization through crafted HTTP requests, potentially leading to arbitrary code execution or sensitive data access. CSRF vulnerabilities provide additional attack opportunities that must be mitigated.
8Core Defense Strategies
Implementing schema validation for every Server Action creates a critical defense layer. The server-only package helps isolate server-side code. Teams should implement CSRF protections beyond framework defaults to prevent request forgery attacks.
9Additional Security Layers
React's Taint API can prevent sensitive data from reaching the client. Web Application Firewalls (WAFs) may filter malicious Flight payloads. However, these solutions aren't sufficient on their own and should be part of a defense-in-depth strategy.
10Developer Awareness
Many teams don't consider the security implications of the Flight protocol. Developers should examine Flight traffic in the Network tab and understand deserialization risks. Security isn't something the framework handles automatically - it requires conscious design decisions.
11Future Risks
As the Flight protocol evolves, new attack vectors will emerge. The modular architecture may lead to inconsistent behavior between different resolvers. Developers must stay informed about security updates in this rapidly changing landscape.
12Conclusions and Recommendations
While React Server Components offer powerful capabilities, the Flight protocol carries significant security risks. Teams should approach deserialization operations with skepticism and implement layered defenses. A balance must be struck between security, performance and developer experience.