3 ms·
I'm sorry, but you're incorrect. That is genuinely how this CVE works. All (and only) code with "use server" was vulnerable.
by jazzypants 11mo ago
I'm sorry, but you're incorrect. That is genuinely how this CVE works. All (and only) code with "use server" was vulnerable.
- vinnymac 11mo agoThe official blog post disagrees. > Even if your app does not implement any React Server Function endpoints it may still be vulnerable if your app supports React Server Components.
- jazzypants 11mo agoOops, yeah. My bad, you're right. It makes sense that any flight server that is capable of interpreting server functions would be vulnerable whether the codebase used them or not. It's an issue in the transport mechanism and not the actual RPC implementation.