Critical RCE Strikes React Server Components, T3 Chat Unveils Post-Next.js Architecture

A critical Remote Code Execution (RCE) vulnerability, assigned a maximum severity score of 10.0, has been disclosed in React server components. Dubbed ‘react2shell’, the exploit targets weaknesses in React’s Flight protocol, specifically in the serialization and deserialization of promises and internal objects. Discovered by Lachlan Davidson and privately reported to Meta on November 29th, a rapid fix and public disclosure followed by December 3rd. The vulnerability affects applications utilizing React Server Components across various frameworks including Next.js, React Router, and Waku. Major hosting providers like Vercel, Cloudflare, and Netlify swiftly implemented temporary firewall mitigations, though users are strongly advised to update to React versions 19.0.1, 19.1.2, or 19.2.1. A real-world instance saw a user’s server compromised for Bitcoin mining, underscoring the urgency of updates and secure deployment practices, such as avoiding root user for containerized applications. In a related incident, Cloudflare experienced an outage stemming from a botched attempt to mitigate this vulnerability within its web application firewall logic, causing internal system errors. Meta and Vercel have been lauded for their swift and transparent response, including a new $50,000 bug bounty program for discovering firewall bypasses.

Amidst the security revelations, T3 Chat has detailed its comprehensive migration from Next.js to the nascent TanStack Start framework. The initial decision to use Next.js was driven by its support for React, TypeScript, scalability, and server-client synchronization, despite necessitating complex workarounds for a client-first, React Router-based Single Page Application (SPA) experience. After exploring alternatives like Remix, Vite + Hono on Cloudflare (which hit bundle size limits), and React Router server versions, the team, led by Julius, opted for TanStack Start to reduce technical debt and gain greater flexibility. This substantial migration, involving thousands of lines of code changes, presented its own set of challenges, including ‘too many files’ and fetch failed errors during Vercel deployments. These issues, attributed to TanStack’s route bundling on Vercel’s Fluid Compute, ultimately required custom Nitro integration for API routes and even patch-packaging TanStack Start’s core to expose internal event helpers. The team emphasizes that this move was a strategic technical decision, unrelated to recent security vulnerabilities or perceived political stances regarding Vercel, and aims to achieve a codebase better aligned with their long-term vision, even if it entails navigating new complexities in an early-stage framework.