React2Shell

1. 1

   A Server Function call is just an HTTP POST.

   React Server Components let part of a React app run on the server. A Server Function (also called a Server Action) is server code the browser can call over the network. Next.js sends that call as a POST request marked with a Next-Action header.

   Nothing about the request proves it came from your own page. Anyone can send one.

   method

   POST

   header

   Next-Action: <action id>

   body

   multipart form data

   login needed

   no

2. 2

   The arguments travel in React's Flight format.

   The Flight protocol is React's own wire format between browser and server. It can say more than JSON can. Each numbered form field is a chunk, and a value inside one chunk can be a reference: roughly “chunk 1, then property a, then property b”.

   A value can also be marked as a promise, or point at an export of a server module.

   chunk 0

   the call's arguments

   chunk 1

   an object

   chunk 2

   a reference: 1 → a → b

   promises

   allowed

   module refs

   allowed

3. 3

   The decoder runs before any of your code.

   To know which function to call and with what, the server first rebuilds live JavaScript objects from the chunks. That happens inside React's Flight reply decoder.

   It runs before your Server Function and before any login check you wrote. Datadog and the discoverer both confirmed that a stock create-next-app production build was exploitable.14

   your functions

   none needed

   auth checks

   not run yet

   app code

   not run yet

   decoder

   ReactFlightReplyServer

4. 4

   A reference is resolved by walking names.

   For “chunk 1 → a → b” the resolver starts at chunk 1 and steps through each name in turn: value = value[name].

   In the vulnerable versions, nothing checked that each name was the object's own data. Any name the caller sent was followed. A second lookup, for server-module exports, had the same gap.6

   for each name

   value = value[name]

   own-property check

   none

   who picks names

   the caller

5. 5

   In JavaScript, value[name] also finds inherited properties.

   Every JavaScript object has a prototype: a shared object it inherits behaviour from, which has its own prototype, and so on. That is the prototype chain. Ask an object for __proto__, constructor or a promise's then and you get that shared machinery, not the object's data.

   Because the resolver accepted any name, a reference could walk out of the data and into the machinery. Datadog describes this as prototype-chain traversal.

   obj["a"]

   the object's own data

   obj["__proto__"]

   its prototype

   obj["constructor"]

   the function that built it

   promise["then"]

   how it is resumed

6. 6

   The decoder's own chunk is promise-like. That is the lever.

   A thenable is any object with a then method; JavaScript automatically calls it when a promise resolves to that object. According to the discoverer's write-up, React's internal chunk type inherited from Promise.prototype and had a then.10

   Using references, an attacker could reach a chunk and plant a then. Automatic promise unwrapping then re-entered the parser with a fake chunk built entirely from attacker data, internal fields included.

   chunk prototype

   Promise.prototype

   then

   reachable by reference

   fake chunk fields

   attacker data

   unwrapping

   automatic

7. 7

   From constructor to Function, and the server runs code.

   Following constructor properties eventually reaches JavaScript's Function constructor, which turns a string into runnable code. The decoder calls it while it believes it is resolving an ordinary value.

   The code runs as the Node.js server process, with its environment variables, files and network. Attackers used it to read secrets and cloud credentials, then install crypto miners, backdoors and tunnels.13

   runs as

   the server process

   reach

   env vars, files, cloud metadata

   seen in the wild

   miners, backdoors, tunnelers

   login needed

   no

8. 8

   The fix: only an object's own properties count.

   Sebastian Markbåge's PR #35277, merged 3 Dec 2025 at 15:41 UTC and released as 19.0.1, 19.1.2 and 19.2.1, steps into a name only when the value is an object and hasOwnProperty says the name is its own. Module-export lookups got the same guard.

   The chunk type was restructured, and the server's reply decoder was brought back in line with the client-side decoder it had drifted from.6

   step into name

   only if own property

   inherited names

   resolve to nothing

   module exports

   own exports only

   RCE

   closed; DoS follow-ups kept coming

The numbered markers on the diagram match the steps.