React2Shell: When the Framework Is the Attack Surface

For years the advice was simple: validate input, escape output, patch your dependencies. Then a deserialization flaw in the React Server Components protocol turned an unauthenticated HTTP request into remote code execution across an entire generation of Next.js applications.

Why It Mattered

The vulnerability did not live in anyone's business logic. It lived in the framework's wire protocol — the thing every App Router app trusts implicitly. A crafted request walked an object reference into a server-side gadget chain. No credentials, no user interaction, no exotic preconditions.

"You cannot out-validate a bug in the layer doing the validating."

What We Tell Clients

• Inventory your framework versions like they are dependencies — because they are. A version banner in a JavaScript bundle is an asset, and an attacker's first query.
• Patch latency is exposure. Mass exploitation of this class began within days of disclosure.
• Rotate secrets after patching. If the app was reachable while vulnerable, assume the environment was readable.

Cryptex Labs tracks framework-level advisories against client estates and validates exposure with non-destructive checks — so the answer to "are we affected?" is evidence, not a guess.