Welcome to the Server: Where Vulnerabilities Hide in Next.js App Router

In December 2025, a series of critical vulnerabilities were discovered in React and Next.js. Patches were released promptly, and the issue was contained. But for those working with App Router, this incident is a reason to look deeper and ask: what architectural decisions made this possible?

In this talk, we'll dissect the App Router architecture from the inside: how the React Flight Protocol works, how the server and client component graphs are split during bundling, what the server accepts, what it trusts, and what it executes. We'll find the exact spot in the architecture where the vulnerability lived — and understand why it ended up there.

This talk is an architectural deep dive into Next.js App Router through the lens of security: we'll rethink the RSC trust model, figure out where the real boundary between client and server lies, what can come from the outside, and why "use server" can be viewed as declaring an attack surface.