# React Server Components · Tech watch

[Canonical source](<https://sebastien.rigaux.be/en/tech-watch/tags/react-server-components>)

React components executed on the server and composed with interactive client components.

Related tags : [Next.js](<https://sebastien.rigaux.be/en/tech-watch/tags/nextjs>) · [React](<https://sebastien.rigaux.be/en/tech-watch/tags/react>)

## [React Server Components: critical remote code execution flaw](<https://sebastien.rigaux.be/en/tech-watch/links/react-server-components-critical-remote-code-execution-flaw>)

A critical vulnerability enables unauthenticated remote code execution in some applications using React Server Components. It affects `react-server-dom-webpack`, `react-server-dom-parcel`, and `react-server-dom-turbopack` in the versions listed in the advisory, with a CVSS score of 9.5.

The described scenario is rare: it requires responses that transport multiple typed arrays and an attacker-controlled value. React applications without a server are unaffected, as are applications that do not use a framework, bundler, or plugin supporting Server Components. Fixes are available in 19.0.9, 19.1.10, 19.2.9, and 19.3.1; affected deployments should upgrade immediately.

2026-10-23 · [Markdown](<https://sebastien.rigaux.be/en/tech-watch/links/react-server-components-critical-remote-code-execution-flaw.md>) · [Original resource](<https://github.com/react/react/security/advisories/GHSA-xqc2-xf4c-x3h3?ck_subscriber_id=2550494205&utm_source=convertkit&utm_medium=email&utm_campaign=%E2%9A%9B%EF%B8%8F%20This%20Week%20In%20React%20%23302%3A%20Next.js%2C%20React%20Router%2C%20DevTools%2C%20Security%2C%20shadcn%2C%20Hydrogen%2C%20Vinext%2C%20Mutative%2C%20R3F%20%7C%20RN%200.88%2C%20Expo%2058%2C%20Navigation%2C%20FastImage%2C%20Screens%2C%20Device%20Hub%2C%20Edge%20to%20Edge%20%7C%20TypeScript%2C%20PHP%2C%20CrUX%2C%20Rsdoctor%2C%20Astro%20-%2023823401>)

## [Manage advanced URL filters in the Next.js App Router](<https://sebastien.rigaux.be/en/tech-watch/links/manage-advanced-url-filters-in-the-next-js-app-router>)

Aurora Scharff uses URL parameters as the source of truth for filtering, sorting and pagination. The article covers coordinating that state with interactions and Server Components.

2024-11-07 · [Markdown](<https://sebastien.rigaux.be/en/tech-watch/links/manage-advanced-url-filters-in-the-next-js-app-router.md>) · [Original resource](<https://aurorascharff.no/posts/managing-advanced-search-param-filtering-next-app-router/>)

## [Compose Server and Client Components in Next.js](<https://sebastien.rigaux.be/en/tech-watch/links/compose-server-and-client-components-in-next-js>)

The documentation explains where data fetching, secrets and interactions belong in the App Router. Examples show how to pass server-fetched data into interactive Client Components.

2023-10-25 · [Markdown](<https://sebastien.rigaux.be/en/tech-watch/links/compose-server-and-client-components-in-next-js.md>) · [Original resource](<https://nextjs.org/docs/app/getting-started/server-and-client-components>)