A maximum severity vulnerability, dubbed 'React2Shell', in the React Server Components (RSC) 'Flight' protocol allows remote code execution without authentication in React and Next.js applications.

一年两个高危CVE，React/Next.js的问题不是SSR，是前端被逼着干后端的活 CVE年年有，今年特别多，这不稀奇。什么时候开始一个”前端框架”的漏洞，能造成这么大的攻击面了？ 2015年的React就是个View层的库，Virtual DOM diff一下完事儿。现在你点开Next.js的文档看看，Server Components、Server ...

Experts have warned there is a critical severity flaw in the Next.js open source web development framework which allows threat actors to bypass authorization checks. Security researcher Rachid.A from ...