Security Vulnerabilities and Defense Strategies in React Flight Protocol
Deserialization risks in React Server Components and mitigation approaches.
1Introduction to React Flight Protocol
React Server Components use a custom protocol called Flight instead of sending HTML or JSON to the browser. This protocol is designed to efficiently transfer component trees between server and client. However, understanding how this protocol works is crucial for preventing security vulnerabilities.
2Structure of the Flight Protocol
The Flight protocol uses a line-delimited format where each line represents a specific data type. These lines can include JSON trees, module references, and cross-line pointers. The complex structure of this protocol involves deserialization processes that can lead to security vulnerabilities.
3Deserialization Risks
The Flight protocol uses deserialization to reconstruct executable references and components on the client side. This process can allow attackers to inject malicious code. Particularly, '$'-prefixed references can lead to security vulnerabilities.
4React2Shell Vulnerability
React2Shell, discovered in December 2025, was a critical security vulnerability caused by a deserialization flaw in the Flight protocol. This flaw allowed attackers to execute remote code without authentication. It was added to CISA's Known Exploited Vulnerabilities catalog.
5Attack Surface
The deserialization processes in the Flight protocol present a broad attack surface beyond a single error check. Attackers can abuse module references, server RPC endpoints, and async states. This seriously threatens application security.
6Protocol Examination
Examining the source code of the Flight protocol is essential for understanding security vulnerabilities. Specifically, the getOutlinedModel and getChunk functions contain much of the deserialization logic. These functions play a critical role in identifying attack vectors.
7Line Format and Tags
Each line in the Flight protocol includes a line ID, a tag, and a payload. Tags represent different data types, such as JSON trees, module metadata, and error boundaries. Understanding how these tags are processed helps prevent security vulnerabilities.
8$ Prefix System
References prefixed with '$' in the Flight protocol are routed through type-specific resolution paths on the client side. These references include model references, server references, and lazy components. This system offers many points that attackers can exploit.
9Attack Scenarios
Attackers can execute various scenarios by exploiting deserialization flaws in the Flight protocol. For example, they can run remote code without authentication via server functions. Such attacks seriously threaten application security.
10Defense Strategies
Various defense strategies can be implemented to prevent security vulnerabilities in the Flight protocol. These include schema validation for every Server Action, using server-only packages, and CSRF hardening. These measures significantly reduce the attack surface.
11Taint API and WAFs
React's Taint API and Web Application Firewall (WAF) solutions can help mitigate security vulnerabilities in the Flight protocol. However, these tools alone are not sufficient and should be used alongside other defense strategies.
12Conclusion and Recommendations
Deserialization risks in the React Flight protocol can seriously threaten application security. Developers should understand how the protocol works and implement appropriate defense strategies to mitigate these risks. Security should always be the top priority.