Critical React, Next.js flaw lets hackers execute code on servers

A critical vulnerability dubbed 'React2Shell' affects React Server Components (RSC) Flight protocol in React and Next.js applications. The maximum severity flaw allows remote code execution without authentication. The vulnerability exists in the server-side rendering components and can be exploited by attackers to execute arbitrary JavaScript code on vulnerable servers. This affects applications built with React and Next.js frameworks that utilize React Server Components. The flaw represents a significant security risk for web applications using these popular JavaScript frameworks.