Security risks of SSR/RSC and examples of how to mitigate them

▤ Summary

This article explains security risks in React and Next.js architectures, especially SSR, RSC, and Server Actions. It walks through the differences between Pages Router and App Router, then shows how HTML, JavaScript, and Flight payloads are generated and processed. The piece highlights common attack classes such as XSS, broken access control, DoS, SSRF, and RCE, with examples tied to specific Next.js and React CVEs. It also outlines mitigation ideas such as CSP, WAF, DMZ-style isolation, and stronger runtime controls for server actions and Flight handling.

▦ Linked Companies