# Security Vulnerabilities and Defense Strategies in React Flight Protocol

Deserialization risks in React Server Components and mitigation approaches.

- **Source:** [Articles on Smashing Magazine — For Web Designers And Developers](https://brifing.si/source/e66a90c0-835e-4d99-8b50-d2215183ea28)
- **Published:** 2026-07-21
- **Topic:** [Software & Engineering](https://brifing.si/c/engineering)
- **Original article:** <https://smashingmagazine.com/2026/07/weaponizing-defending-react-flight-protocol/>
- **On Brifing:** https://brifing.si/s/c479ebd8-0211-460f-a0f6-1ed86d9f78e3

## Introduction to React Flight Protocol

React Server Components use a custom protocol called Flight instead of sending HTML or JSON to the browser. This protocol is designed to efficiently transfer component trees between server and client. However, understanding how this protocol works is crucial for preventing security vulnerabilities.

## Structure of the Flight Protocol

The Flight protocol uses a line-delimited format where each line represents a specific data type. These lines can include JSON trees, module references, and cross-line pointers. The complex structure of this protocol involves deserialization processes that can lead to security vulnerabilities.

## Deserialization Risks

The Flight protocol uses deserialization to reconstruct executable references and components on the client side. This process can allow attackers to inject malicious code. Particularly, '$'-prefixed references can lead to security vulnerabilities.

## React2Shell Vulnerability

React2Shell, discovered in December 2025, was a critical security vulnerability caused by a deserialization flaw in the Flight protocol. This flaw allowed attackers to execute remote code without authentication. It was added to CISA's Known Exploited Vulnerabilities catalog.

## Attack Surface

The deserialization processes in the Flight protocol present a broad attack surface beyond a single error check. Attackers can abuse module references, server RPC endpoints, and async states. This seriously threatens application security.

## Protocol Examination

Examining the source code of the Flight protocol is essential for understanding security vulnerabilities. Specifically, the getOutlinedModel and getChunk functions contain much of the deserialization logic. These functions play a critical role in identifying attack vectors.

## Line Format and Tags

Each line in the Flight protocol includes a line ID, a tag, and a payload. Tags represent different data types, such as JSON trees, module metadata, and error boundaries. Understanding how these tags are processed helps prevent security vulnerabilities.

## $ Prefix System

References prefixed with '$' in the Flight protocol are routed through type-specific resolution paths on the client side. These references include model references, server references, and lazy components. This system offers many points that attackers can exploit.

## Attack Scenarios

Attackers can execute various scenarios by exploiting deserialization flaws in the Flight protocol. For example, they can run remote code without authentication via server functions. Such attacks seriously threaten application security.

## Defense Strategies

Various defense strategies can be implemented to prevent security vulnerabilities in the Flight protocol. These include schema validation for every Server Action, using server-only packages, and CSRF hardening. These measures significantly reduce the attack surface.

## Taint API and WAFs

React's Taint API and Web Application Firewall (WAF) solutions can help mitigate security vulnerabilities in the Flight protocol. However, these tools alone are not sufficient and should be used alongside other defense strategies.

## Conclusion and Recommendations

Deserialization risks in the React Flight protocol can seriously threaten application security. Developers should understand how the protocol works and implement appropriate defense strategies to mitigate these risks. Security should always be the top priority.

## Sources covering this story

- https://smashingmagazine.com/2026/07/weaponizing-defending-react-flight-protocol/ — 

---

_Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._