Preliminary research
ReactGhost: A Study in Flight Protocol Trust Boundaries
AI-collected research leads through 2 October 2026, including bounded month-by-month reviews of selected social and community sources from March through September. Unranked, incomplete, not community-vetted, and subject to change.
Revisits the React Flight protocol after React2Shell and documents adjacent trust-boundary failures in the ESM loader, client decoder and server-reference manifest paths. Static analysis and runtime reproductions show inherited-property traversal and attacker-influenced module resolution across specific React and Next.js releases, while recording the vendor's disputed assessment.
Record
- Researcher
- ReactGhost
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of ReactGhost, first published at the original source. Preserved copies are kept so the citation survives its host.