Critical React, Next.js flaw lets hackers execute code on servers

A critical vulnerability dubbed 'React2Shell' affects React Server Components (RSC) 'Flight' protocol in React and Next.js applications. The maximum severity flaw allows remote code execution without authentication. The vulnerability impacts the server-side rendering components and could allow attackers to execute arbitrary JavaScript code on servers running affected applications. This represents a significant threat to web applications built with these popular JavaScript frameworks.