Tag: react-server-components

Server Actions and Flight Endpoints: Auditing RSC Trust Boundaries After the Authless RCE Report

pr0h0•November 9, 2026

A deep technical walkthrough of how React Server Components' Flight protocol and Server Actions handle serialized payloads, why the reported authless RCE bypassed authentication at the trust boundary, and how to audit and harden your own RSC endpoints.

react-server-componentsserver-actionssecurity

Testing Next.js App Router for Single-Request RSC Denial-of-Service

pr0h0•October 10, 2026

A code-level analysis of the React Server Components denial-of-service vector that lets a single crafted request exhaust Next.js App Router server resources, along with the defensive configurations and mitigations developers should apply.

nextjsreact-server-componentssecurity