--- title: Weaponizing And Defending The React Flight Protocol:... description: A deep technical analysis of the React Flight protocol's deserialization attack surface, centered on CVE-2025-55182 (React2Shell), a CVSS 10.0 unauthenticated... canonical: https://daily.dev/posts/weaponizing-and-defending-the-react-flight-protocol-deserialization-sinks-in-rscs-smashing-magazi-g6udo9van twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Weaponizing And Defending The React Flight Protocol: Deserialization Sinks In RSCs — Smashing Magazine | daily.dev og:description: A deep technical analysis of the React Flight protocol's deserialization attack surface, centered on CVE-2025-55182 (React2Shell), a CVSS 10.0 unauthenticated... og:url: https://daily.dev/posts/weaponizing-and-defending-the-react-flight-protocol-deserialization-sinks-in-rscs-smashing-magazi-g6udo9van og:image: https://api.daily.dev/og/posts/G6UDO9VaN.png og:image:alt: Weaponizing And Defending The React Flight Protocol: Deserialization Sinks In RSCs — Smashing Magazine og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Weaponizing And Defending The React Flight Protocol: Deserialization Sinks In RSCs — Smashing Magazine **[Smashing Magazine](https://daily.dev/sources/smashing)** · 28 min read · 0 upvotes · 0 comments ## Summary A deep technical analysis of the React Flight protocol's deserialization attack surface, centered on CVE-2025-55182 (React2Shell), a CVSS 10.0 unauthenticated RCE vulnerability. The Flight protocol uses a custom streaming format with a `$` prefix system that reconstructs executable references, module imports, and RPC endpoints on the client. The root cause was a missing `hasOwnProperty` check in `getOutlinedModel`, allowing prototype chain traversal via `$:` path references to reach the `Function` constructor and execute arbitrary code. The exploit was weaponized by North Korean state actors within hours of disclosure. The article covers the full gadget chain, the React team's patch, and a ranked set of defenses: schema validation on every Server Action (Zod/Valibot), the `server-only` package, CSRF hardening, version verification, the Taint API's limitations, and WAF rules. Additional structural risks including MITM on the Flight stream, Server Action enumeration, encrypted closure tampering, and supply chain activation via module IDs are also examined. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [The React2Shell Story](https://daily.dev/posts/the-react2shell-story-gcisumgod) · Hacker News · 4 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#react](https://daily.dev/tags/react) [View this post on daily.dev](https://daily.dev/posts/weaponizing-and-defending-the-react-flight-protocol-deserialization-sinks-in-rscs-smashing-magazi-g6udo9van) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Weaponizing And Defending The React Flight Protocol: Deserialization Sinks In RSCs — Smashing Magazine","url":"https://daily.dev/posts/weaponizing-and-defending-the-react-flight-protocol-deserialization-sinks-in-rscs-smashing-magazi-g6udo9van","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/weaponizing-and-defending-the-react-flight-protocol-deserialization-sinks-in-rscs-smashing-magazi-g6udo9van"},"datePublished":"2026-07-21T13:56:07.454Z","dateModified":"2026-08-24T06:52:48.331Z","description":"A deep technical analysis of the React Flight protocol's deserialization attack surface, centered on CVE-2025-55182 (React2Shell), a CVSS 10.0 unauthenticated...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5a62123db045266bdb10c4fb6eef3d02?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5a62123db045266bdb10c4fb6eef3d02?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Smashing Magazine","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Smashing Magazine","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/smashing","url":"https://daily.dev/sources/smashing"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/weaponizing-and-defending-the-react-flight-protocol-deserialization-sinks-in-rscs-smashing-magazi-g6udo9van","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,react","timeRequired":"PT28M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Smashing Magazine","item":"https://daily.dev/sources/smashing"},{"@type":"ListItem","position":3,"name":"Weaponizing And Defending The React Flight Protocol: Deserialization Sinks In RSCs — Smashing Magazine"}]} ```