Inside React Flight: The Deserialization Risk Behind RSCs How React Server Components stream behavior, not just data — and why CVE-2025-55182 (React2Shell) turned that design into a CVSS 10.0 RCE. Practical defenses inside.