React Server Components (RSC) is a modern architecture used by popular frameworks like Next.js to build high-performance, interactive web applications. Given its role in rendering user interfaces and managing server-side logic, it represents a critical component of the application stack. This vulnerability represents a maximum-impact scenario: a pre-authentication Remote Code Execution (RCE) vulnerability with a CVSS score of 10.0, meaning an unauthenticated attacker from the internet can achieve full server compromise with minimal complexity.

The risk is exceptionally high for all publicly exposed web applications built with vulnerable versions of React or frameworks that utilize RSC. Public exploit code is available, and given the ease of exploitation and the severe impact, large-scale automated attacks are highly probable. This vulnerability is an ideal candidate for inclusion in CISA’s Known Exploited Vulnerabilities (KEV) catalog, and organizations should assume it is being actively exploited. A successful attack allows the adversary to gain full control of the server, resulting in data breaches, ransomware deployment, or the use of the server to attack other internal systems.

Technical Summary

The root cause of this vulnerability is CWE-502: Deserialization of Untrusted Data during the handling of React Server Function payloads. Server Functions are designed to allow client-side components to execute code on the server, but a flaw in the deserialization logic allows an attacker to control the type of object instantiated and its properties.

The attack chain is as follows:

1. The attacker creates a malicious serialized object containing a “gadget chain”—a sequence of code instructions that will be executed upon deserialization.
2. This payload is sent via an HTTP POST request to a publicly exposed Server Function endpoint.
3. The server-side component receives the request and attempts to deserialize the payload into a valid object, implicitly trusting its content.
4. The deserialization process triggers the malicious gadget chain, leading to arbitrary code execution within the context of the web server’s user account.

A conceptual representation of the vulnerability:

// Vulnerable Code
function deserialize(payload) {
  // Directly deserializes untrusted input, allowing
  // attackers to create objects that execute code.
  return unsafe_deserialize(payload);
}

// Patched Code
function deserialize(payload) {
  // The corrected version validates input against a strict
  // allow-list of known, safe object types before deserialization.
  if (!is_safe_type(payload)) {
    throw new Error("Invalid payload type");
  }
  return safe_deserialize(payload);
}

Affected versions: All versions of React Server Components and frameworks like Next.js prior to the latest security updates are considered vulnerable. Fix: The vulnerability has been resolved in the latest versions. Attacker capability: An attacker can execute any command on the underlying server, allowing them to read/write/delete files, exfiltrate sensitive data, install malware, or move laterally to other systems on the network.

Recommendations

• Apply patches immediately: Update all instances of React and related frameworks (e.g., Next.js) to the latest corrective versions released by the vendor. This is the only way to fully remediate the vulnerability.

• Mitigations:

  • Deploy a Web Application Firewall (WAF) with specific rules designed to inspect and block malicious serialized payloads directed at Server Function endpoints. Several WAF vendors have already released rules for this threat.
  • If patching cannot be applied immediately, restrict network access to the vulnerable application to trusted sources only. This is a temporary measure and does not replace patching.

• Research and monitoring:

  • Check web server and application logs for HTTP POST requests to Server Function endpoints with unusual or abnormally large payloads.
  • Monitor for anomalous processes originating from the web server parent process (e.g., node). Look for unexpected network connections, shell commands (sh, bash, powershell), or file modifications in unusual directories.
  • Look for endpoint requests containing patterns indicative of deserialization probes or exploits.

• Incident Response:

  • If a compromise is suspected, immediately isolate the affected host from the network to prevent lateral movement.
  • Preserve all relevant logs, memory dumps, and disk images for forensic analysis.
  • Assume all credentials or secrets stored on or accessible by the compromised server are compromised and initiate rotation procedures.

• Defense-in-Depth:

  • Run the web application under a low-privilege service account to limit the immediate impact of an RCE.
  • Use network segmentation to prevent a compromised web server from accessing critical internal systems such as databases or administrative networks.
  • Maintain and regularly test a robust backup and recovery plan.