Denial of service and source code exposure in React Server Components

#1

Post by sangeeth96 » Thu, Dec 11, 2025, 8:46 PM UTC

Denial of service and source code exposure in React Server Components
react.dev

Re: Denial of service and source code exposure in React Server Components

#2

Post by chuckadams » Thu, Dec 11, 2025, 9:06 PM UTC

I remember when the point of an SPA was to not have all these elaborate conversations with the server. Just "here's the whole app, now only ask me for raw data."

Re: Denial of service and source code exposure in React Server Components

#3

Post by tshaddox » Thu, Dec 11, 2025, 9:12 PM UTC

chuckadams wrote: post #2

I remember when the point of an SPA was to not have all these elaborate conversations with the server. Just "here's the whole app, now only ask me for raw data."

That was indeed one of the main points of SPAs, but React Server Components are generally not used for pure SPAs.

Re: Denial of service and source code exposure in React Server Components

#4

Post by rikafurude21 » Thu, Dec 11, 2025, 9:23 PM UTC

Im confused, did the update from last week for the RCE bug also include fixes for these new CVEs or will I need to update again? npm audit says theres no issues

Re: Denial of service and source code exposure in React Server Components

#5

Post by billywhizz » Thu, Dec 11, 2025, 9:27 PM UTC

rikafurude21 wrote: post #4

Im confused, did the update from last week for the RCE bug also include fixes for these new CVEs or will I need to update again? npm audit says theres no issues

is it not obvious?

> These issues are present in the patches published last week.

> The patches published last week are vulnerable.

> If you already updated for the Critical Security Vulnerability, you will need to update again.

Re: Denial of service and source code exposure in React Server Components

#6

Post by [deleted] » Thu, Dec 11, 2025, 9:36 PM UTC

chuckadams wrote: post #2

I remember when the point of an SPA was to not have all these elaborate conversations with the server. Just "here's the whole app, now only ask me for raw data."

[deleted]

Re: Denial of service and source code exposure in React Server Components

#7

Post by reactordev » Thu, Dec 11, 2025, 9:36 PM UTC

tshaddox wrote: post #3

chuckadams wrote: post #2

I remember when the point of an SPA was to not have all these elaborate conversations with the server. Just "here's the whole app, now only ask me for raw data."

That was indeed one of the main points of SPAs, but React Server Components are generally not used for pure SPAs.

Correct, their main purpose is ecosystem lock-in. Because why return json when you can return html. Why even build a SPA when the old school model of server-side includes and PHP worked just fine? TS with koa and htmx if you must but server-side react components are kind of a waste of time. Give me one example where server side react components are the answer over a fetch and json or just fetching an html page?

Re: Denial of service and source code exposure in React Server Components

#8

Post by rustystump » Thu, Dec 11, 2025, 9:41 PM UTC

chuckadams wrote: post #2

I remember when the point of an SPA was to not have all these elaborate conversations with the server. Just "here's the whole app, now only ask me for raw data."

It also decoupled fe and backend. You could use the same apis for say mobile, desktop and web. Teams didnt have to cross streams allowing for deeper expertise on each side.

Now they are shoving server rendering into react native…