React Server Components Flight Protocol: Deserialization Risks and Defenses

React Server Components do not send HTML to the browser, and they do not send plain JSON either. What travels over the wire is the Flight protocol, a line-delimited, streaming format with its own type system, reference resolution rules, and module pointers that the client-side React runtime quietly reassembles into a live component tree. Because the framework handles the reassembly for you, most development teams have never inspected a single Flight payload. That implicit trust is exactly what made the December 2025 disclosure of CVE-2025-55182, nicknamed React2Shell, so alarming. It was a CVSS 10.0 unauthenticated remote code execution flaw living inside Flight's deserialization layer, and one crafted HTTP request to a Server Function endpoint was enough to give an attacker shell access without credentials.

CISA added the bug to the Known Exploited Vulnerabilities catalog, and researchers tied in-the-wild activity to state-sponsored actors distributing file-less implants through blockchain transactions. React2Shell was not a one-off parsing mistake. It was a signal that any protocol capable of reconstructing executable references, lazy components, server endpoints, and async state from a text stream behaves like a deserialization system, and inherits the same class of risks.

Key Takeaways

• Flight is a streaming protocol with its own row tags, reference IDs, and prefix system, not a JSON blob.
• The $ system is the heart of the attack surface, because prefixes like $F and $@ resolve into callable functions and internal chunk objects.
• React2Shell proved that a single missing property check in deserialization logic can yield unauthenticated remote code execution.
• Schema validation on every Server Action, strict server-only boundaries, and CSRF hardening are the highest-impact defenses.
• WAFs and the React Taint API help, but neither replaces application-layer input validation.

How Flight Works on the Wire

Open the Network tab on any Next.js App Router page and filter for responses with Content-Type text/x-component. Each response is a stream of newline-terminated rows. Every row follows the same shape: a numeric row ID, a single-character tag, and a payload. The client-side runtime consumes rows as they arrive and stitches them into a component tree.

A minimal payload already reveals the structure. A row beginning with I tells the client to import a client component from the bundler's chunk map. A row beginning with J carries a serialized virtual DOM tree, complete with $-prefixed references that point back to other rows. A row beginning with D describes the server execution context, including environment markers. Together these rows reconstruct live behavior, not just markup.

The Row Tags That Matter

• J (JSON Tree): Serialized virtual DOM nodes, props, and HTML elements.
• I (Import): A directive that loads a client component module from the chunk map.
• M (Module): Metadata for a specific client component or chunk.
• D (Data): Server-rendered element context and environment information.
• E (Error): Serialized server-side exceptions and error boundaries.
• HL (Hint/Preload): Browser preload instructions for stylesheets and fonts.

Why Flight Is a Deserialization Sink

The risk concentrates in the prefix system. When the parser sees a string starting with $, it does not treat it as literal text. It routes the value through a switch statement on the next character and triggers type-specific resolution. A handful of prefixes turn user-controlled strings into executable behavior:

• $ Model Reference: Resolves to another row, for example $2 points to row 2.
• $: Property Access: Walks into a resolved chunk's properties, such as $1:user:name.
• $S Symbol: Constructs a native JavaScript Symbol.
• $F Server Reference: Represents a callable Server Action, essentially an RPC endpoint on the server.
• $L Lazy Component: Defers component loading until render time.
• $@ Promise/Raw Chunk: Returns the internal Chunk wrapper object itself, which carries pending callbacks and mutable metadata.
• $B Blob/Binary: Invokes the binary data deserialization handler.

Two prefixes deserve extra attention. $F turns a string into a remote procedure call into your server, and $@ hands the client a mutable internal object rather than a resolved value. Exploit chains typically abuse $@ to grab a handle on internal state, then pivot through $F to invoke a Server Action under attacker control.

The Mechanics of React2Shell

CVE-2025-55182 landed in December 2025 and earned its React2Shell nickname by delivering unauthenticated RCE through a single HTTP request. The vulnerable code paths sat inside the Flight client's resolution routines, primarily getOutlinedModel and getChunk. The root cause was an inadequate property-access check when the parser followed $: chains. Because the parser resolved references recursively across rows, a crafted payload could traverse into objects it was never meant to touch, eventually reaching constructors and prototype-adjacent paths that yielded code execution.

Several factors amplified the blast radius. Server Functions are reachable from any page that renders a Server Component subtree, so exposure scales with every route that uses the App Router. The framework's defaults made request bodies and content types permissive, which made it easy for attackers to reach the vulnerable parser. And because Flight responses are streamed, partial exploitation can begin before the full payload arrives.

React2Shell vs. Typical Web Vulnerabilities

Defenses Ranked by Impact

Not every control moves the needle equally. The following list reflects what actually reduces risk for teams running React Server Components in production today.

1. Schema Validation on Every Server Action

Validate the arguments of every Server Action with a schema library such as Zod, Valibot, or your runtime of choice. Treat the Flight payload as untrusted input, because it is. Reject unknown keys, enforce length limits, and coerce types before any business logic runs. This single habit blunts most deserialization chains that rely on traversing into unexpected properties.

2. The server-only Package

Import the server-only package at the top of every module that holds secrets, database clients, or internal APIs. Build-time enforcement turns accidental client imports into hard errors, which prevents sensitive code from leaking into bundles that the Flight importer can request.

3. CSRF Hardening Beyond Framework Defaults

Server Actions need explicit CSRF protection. Use SameSite=Lax or Strict cookies, require a custom header that simple cross-origin forms cannot set, and verify origin or referer for state-changing calls. For high-value endpoints, layer in a token-based check that the client fetches from a same-origin endpoint. If you ship a Next.js or Node application behind an edge, [Advanced DDoS Protection](https://www.sitecountry.com/ddos-protection/) can strip volumetric junk before it reaches your application.

4. Taint API and Output Hygiene

The experimental Taint API lets you mark values, such as secrets or untrusted URLs, so React refuses to pass them to client components. Use it for tokens, signing keys, and any value that should never leave the server. Pair it with strict CSP, Trusted Types where supported, and a Content Security Policy that disallows inline scripts.

5. WAFs and Edge Filtering

A Web Application Firewall cannot deserialize your payload, but it can block obvious exploit patterns, throttle abusive clients, and shield you during the window between disclosure and patching. If you operate on a budget, starting with [Free DDoS Protection](https://www.sitecountry.com/free-ddos/) adds a baseline layer without changing your stack.

What Came After React2Shell

The maintainers shipped a fix quickly, but the underlying pattern has not disappeared. Researchers continue to probe $: traversal, $F invocation, and the $@ chunk handle. New bypasses have appeared in adjacent parsers, including tooling that processes Flight payloads outside the React runtime. Each disclosure reinforces the same lesson: any time a protocol reconstructs behavior from text, it is a deserialization system, and it deserves the same threat modeling you would give pickle, YAML, or Java serialization.

What Is Still Exposed

Even after patching, several surfaces deserve attention. Public Server Actions that accept complex objects remain the easiest pivot point. Streaming responses enlarge the window for partial exploitation. Custom bundler configurations that loosen chunk map access controls can widen the import surface. And any third-party library that reads text/x-component traffic, including CDNs, log shippers, and dev tools, becomes a secondary attack surface in its own right.

This Has Happened Before

Java deserialization taught the industry that remote code execution can hide inside a stream of bytes that looks harmless. YAML load, PHP object injection, and Python pickle all repeated the lesson. React Flight is the web-native version of that story: a streaming format designed for performance that quietly carries executable references across the trust boundary. Treat it with the same skepticism you would give any other deserialization layer.

Frequently Asked Questions

What is the React Flight protocol in simple terms?

Flight is the streaming, line-delimited format React Server Components use to send serialized component data from the server to the client. Each line is a row with an ID, a tag such as J for JSON tree or I for import, and a payload that the client-side runtime reassembles into a live component tree.

Why is CVE-2025-55182 called React2Shell?

The nickname comes from the fact that a single crafted HTTP request to a Server Function endpoint, with no authentication, gave the attacker remote code execution on the server. The vulnerability lived inside Flight's deserialization logic, specifically the resolution paths that follow $-prefixed references.

How should Server Actions be validated?

Validate every argument with a schema library, reject unknown keys, enforce length and shape limits, and coerce types before any logic runs. Treat the incoming payload as untrusted input, because from the server's perspective it is just text that the Flight parser happens to trust.

Does the React Taint API replace input validation?

No. The Taint API prevents sensitive values from being sent to the client, but it does not stop a malicious payload from reaching the server in the first place. You still need schema validation, CSRF protection, and the server-only package to close the deserialization surface.

What hosting controls help defend React Server Components?

Application-layer controls matter most, but edge protections reduce noise. Layered DDoS mitigation, TLS termination with [free SSL](https://www.sitecountry.com/free-ssl/), and isolation through a hardened [Managed Cloud VPS Hosting](https://www.sitecountry.com/cloud-vps/) environment all shrink the attack surface. If a site is already showing signs of tampering, professional [Malware Removal and Security](https://www.sitecountry.com/website-services/) can stop the bleeding before you patch the root cause.

Action Checklist for React Server Components

• Audit every Server Action and confirm that a schema validator rejects unexpected shapes.
• Add server-only imports to every module that touches secrets or internal APIs.
• Require a custom header or token on state-changing Server Actions and verify origin.
• Adopt a strict Content Security Policy and consider Trusted Types for client output.
• Keep Next.js and the React runtime on the latest patch level and subscribe to React security advisories.
• Place a WAF in front of text/x-component endpoints and review its rules after each new disclosure.
• Log and alert on unusual Server Action invocations, especially from unauthenticated clients.

React Server Components give you powerful streaming behavior, and Flight is what makes that possible. The price of that power is treating every payload as deserialization input. Validate aggressively, isolate the server, and keep your edge defenses in place, and you can keep the developer experience without accepting the default trust.