RSC Is Not the Input Boundary

Short summary

React Server Components security issues don't stem from the RSC model itself, but from where input validation occurs in Server Functions. The May 2026 Vercel advisory addressed DoS attacks on deserialization logic—attacks that can't be stopped at WAF layer since they occur during protocol parsing, not in application code. Validation must happen during Flight payload deserialization, not just in handlers, to prevent excessive CPU or memory consumption.

• •RSC and Server Functions have opposite attack surfaces: RSC is server-to-client, Server Functions are client-to-server RPC boundaries
• •The May 2026 Vercel vulnerability exploited deserialization itself, not application logic—application-level validation is too late
• •Input validation must occur during Flight protocol parsing, not in handlers, to prevent DoS attacks on resource consumption

Generated with AI, which can make mistakes.