”use server” is not required for this vulnerability to be exploitable. | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

		cluckindan 3 months ago \| parent \| context \| favorite \| on: RCE Vulnerability in React and Next.js ”use server” is not required for this vulnerability to be exploitable.

sysguest 3 months ago [–]

wait I'm only using React for SPA (no server rendering)

am I also vulnerable??????

cluckindan 3 months ago | | [–]

Only if you are running a vulnerable version of Next.js server.

__jonas 3 months ago | | [–]

No, unless you run the React Server Component runtime on your server, which you wouldn't do with a SPA, you would just serve a static bundle.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact