Critical React, Next.js flaw lets hackers execute code on servers

### Executive summary A severe (CVSS 10/10) unauthenticated remote code execution vulnerability called "React2Shell" was disclosed in React Server Components (Flight) and inherited by Next.js via the react-server package; default configurations of react-server-dom-{parcel,turbopack,webpack} and many Next.js releases are impacted. The advisory lists affected versions and patched releases, warns the flaw stems from insecure deserialization, notes PoCs (some fake) and researcher guidance, and urges immediate auditing and applying the provided fixes.