Critical RCE Vulnerabilities in React and Next.js

Re:Critical RCE Vulnerabilities in React and Next.js by tinco on Wednesday December 03, 2025 @11:29AM (#46136445)

Unsafe deserialization is a very 2010 Ruby on Rails sort of vulnerability. It is strangely interesting that such a vulnerability was introduced so late in the lifetime of these frameworks. It must be a very sneaky vulnerability given how cautious we have become around deserialization since then.

[ Parent | on HN ]

Re:Critical RCE Vulnerabilities in React and Next.js by Tomuus on Wednesday December 03, 2025 @11:42AM (#46136624)

The React Server Components wire format (Flight) is relatively novel and very new (it has existed in React stable for just a year). This is not a simple JSON parsing bug.

[ Parent | on HN ]

Re:Critical RCE Vulnerabilities in React and Next.js by tinco on Wednesday December 03, 2025 @11:55AM (#46136823)

The rails bugs weren't about Json parsing, they were deserializing into Ruby objects of classes that had side effects, and those side effects led to RCE possibilities. Since those happened, you'll find any deserialization library, especially in dynamic languages, will have a safe (or conversely unsafe) deserialize function to make it more explicit that there's risks involved.

[ Parent | on HN ]

Re:Critical RCE Vulnerabilities in React and Next.js by LunaSea on Wednesday December 03, 2025 @11:38AM (#46136581)

I'm willing to bet that this is linked to the magic __proto__ object namespace in JavaScript

[ Parent | on HN ]

Re:Critical RCE Vulnerabilities in React and Next.js by jazzypants on Thursday December 04, 2025 @12:56AM (#46144245)

You win!

[ Parent | on HN ]