profile

Syntax

Snack Pack: React RSC Emergency: Stop Everything & Patch Now

Published 3 months ago • 4 min read

A Tasty Treats NEWSLETTER for Web Developers

Issue #59:

  • React RSC vulnerability goes DEFCON 1 — you really need to upgrade
  • FizzBuzz in pure CSS, because reality is officially optional now
  • 22 fresh CSS features dropped and your layout skills are already obsolete
  • Should we have skipped JSON entirely and gone straight to binary?
  • Optical illusions for when your brain has already melted from patching servers

BREAKING NEWS

If you have not heard yet, a critical vulnerability in React Server Components was found. UPGRADE RIGHT NOW. This is bad. Really really bad. This affects any server using RSC's including Next.js.

For a detailed timeline of what happened see this article by wiz.

This vulnerability is being actively exploited in the wild. For a deep dive into how servers are being PWNED see this article by wiz as well.

TLDR: Just read this whole thing and stop trying to "save time". This is really bad and you should understand the impact. This is a pre-authentication remote code execution vulnerability (CVE score of 10!!). Every single version of React since v19.0.0 and every single version of Next.js since 14.3.0-canary.77 is vulnerable.

  • Pre-authentication means middleware will not save you, the exploit happens before any possible auth code runs
  • Remote code execution is the worse possible type of vulnerability - an attacker can execute code ON YOUR SERVER, they can steal sensitive environment variables, crash the server, move laterally through your network...
  • The POC (proof of concept) that was released shows just how bad this is, a single POST request sent to a vulnerable React / Next.js server will exploit it
  • All of the major hosting providers (Vercel, AWS, Microsoft, Cloudflare, Fastly, Akamai, F5, Google, Deno, Netlify, Railway, Fly, and others) released WAF (web application firewall) block rules of the attack before the patch was released so you might be protected if you do not upgrade, but these WAF rules are being bypassed in the wild as well.

Stay safe out there. Keep your packages up to date and stop writing vulnerable object access code.

-CJ

​Fizz Buzz in CSS

FROM CJ

CSS is becoming more and more capable... Susam shows us how to do Fizz Buzz in pure CSS!

​Do's and Don'ts of useEffectEvent in React

CJ'S LINK

useEffectEvent was released in v19.2 of React and allows us to extract non-reactive logic from Effects. This article breaks down how it works and how to use it.

​CSS Wrapped 2025​ ​

THIS IS CJ'S NEWSLETTER NOW

The chrome dev team recaps 22 new CSS and UI features that landed on the web platform.
​

​In 1995, a Netscape employee wrote a hack in 10 days that now runs the Internet​

IF YUOU'RE READING THIS SAY THX TO CJ ON X

A quick recap of how it all started. JS was created 30 years ago!

​
​

just for fun:

​Optical Toys

fun PROVIDED by KAITLIN

Optical illusions and brain bending toys

The Feed

New videos 3×/week

CJ's CORNER

All Hail The Algorithm

Some good stuff™ from the socials

Dmitrii thinks we should have skipped JSON and went straight to binary.

​SHAMELESS PLUG​

Sentry built AI straight into their parts where teams lose time, turning existing data into instant context — it’s now available to all Sentry users.

Syntax 2025 × Unsubscribe​

thanks for being a part of the pack 💛 curated by: Kaitlin Bloom

Syntax

Read more from Syntax

A Tasty Treats NEWSLETTER for Web Developers Issue #63 Firefox is quietly killing innerHTML. That’s a bigger deal than it sounds. Rust just came for Prettier. Again. Bots aren’t just annoying anymore. They’re changing the web. March MadCSS is almost here. Brackets. Prizes. Chaos. CSS. (Watch our socials for the bracket drop) How we rebuilt Next.js with AI in one week from WES Cloudflare ported Next.js to Vite in a week for $1,100. I don’t believe it, but excited to try. It’s a drop-in...

2 days ago • 3 min read

A Tasty Treats NEWSLETTER for Web Developers Issue #62 Should a new coder use AI — or is that setting them up to fail? jQuery 4.0 is out. Twenty years later and it’s still not done with us Ryan Carniato breaks down the JavaScript framework landscape heading into 2026 We built a real-time CSS battle game… and it actually works Ride a space elevator to orbit and learn where “space” actually starts Introducing the <geolocation> HTML element from cj Chrome introduced a new HTML element that...

17 days ago • 3 min read

A Tasty Treats NEWSLETTER for Web Developers Issue #61 Hack Jurassic Park’s file system like it’s 1993 Cloudflare just acquired Astro — here’s what that actually means for the web Ryan Dahl says the era of humans writing code is over. Cool cool cool.... Dan Abramov explains Bluesky as a social filesystem — and it actually makes sense The Astro Technology Company joins Cloudflare Cloudflare acquired Astro! Here's what it means for Astro. A Social Filesystem Dan Abramov breaks down how the AT...

about 1 month ago • 3 min read