←back to thread

Denial of service and source code exposure in React Server Components

(react.dev)
298 points sangeeth96 | 10 comments | 11 Dec 25 20:46 UTC | HN request time: 0s | source | bottom
1. hedayet ◴[11 Dec 25 22:00 UTC] No.46237810[source]▶
I wonder what does these vulnerabilities mean for Facebook. As per my knowledge, Facebook's the biggest web app written in React.
replies(2): >>46237834 #>>46238943 #
2. jsheard ◴[11 Dec 25 22:02 UTC] No.46237834[source]▶
Does Facebook actually use RSC? I thought it was mainly pushed by the Nextjs/Vercel side of the React team.
replies(2): >>46237934 #>>46238171 #
3. samdoesnothing ◴[11 Dec 25 22:09 UTC] No.46237934[source]▶
No they don't. I think Meta is just big enough that they don't really care what is happening with React anymore haha.
4. acemarke ◴[11 Dec 25 22:28 UTC] No.46238171[source]▶
No, but it's primarily because Meta has their own server infrastructure already. RSCs are essentially the React team trying to generalize the data fetching patterns from Meta's infrastructure into React itself so they can be used more broadly.

I wrote an extensive post and did a conference talk earlier this year recapping the overall development history and intent of RSCs, as best as I understand it from a mostly-external perspective:

- https://blog.isquaredsoftware.com/2025/06/react-community-20...

- https://blog.isquaredsoftware.com/2025/06/presentations-reac...

replies(1): >>46238677 #
5. brazukadev ◴[11 Dec 25 23:13 UTC] No.46238677{3}[source]▶
So contrary to all other changes, this one was not done for Facebook to use. What was the reason behind RSC then?
replies(2): >>46238959 #>>46239743 #
6. tacker2000 ◴[11 Dec 25 23:41 UTC] No.46238943[source]▶
This is about React Server Components, a subset/feature of React that can optionally be installed and used.

Apps that use React without server components are not affected.

7. cluckindan ◴[11 Dec 25 23:43 UTC] No.46238959{4}[source]▶
Market capture?
replies(1): >>46242659 #
8. acemarke ◴[12 Dec 25 01:19 UTC] No.46239743{4}[source]▶
Like I said above and in the post: it was an attempt to generalize the data fetching patterns developed inside of Meta and make them available to all React devs.

If you watch the various talks and articles done by the React team for the last 8 years, the general themes are around trying to improve page loading and data fetching experience.

Former React team member Dan Abramov did a whole series of posts earlier this year with differently-focused explanations of how to grok RSCs: "customizable Backend for Frontend", "avoiding unnecessary roundtrips", etc:

- https://overreacted.io

Conceptually, the one-liner Dan came up with that I liked is "extending React's component model to the server". It's still parent components passing props to child components, "just" spread across multiple computers.

replies(1): >>46242655 #
9. brazukadev ◴[12 Dec 25 10:14 UTC] No.46242655{5}[source]▶
Yeah the "just" is doing a lot of things, nobody asked for a react server but it turns out it could be the base for a $10B cloud company. Classical open source rugpull.
10. brazukadev ◴[12 Dec 25 10:15 UTC] No.46242659{5}[source]▶
That seems to be the case. They killed React for that.