Post

A great technical analysis github.com/ejpir/CVE-20...

Is the vulnerability exclusive to the existence of server components? Their rendering on the server? Their hydration? Can you further explain who is vulnerable?

Assume if you have the affected RSC packages installed, you’re vulnerable.

So that would include pages-only next apps?

Is there an in depth explanation of what the bug is? I'm thinking a github issue/PR/PoC exploit or something similar

At some point in the future we will share details. For now we are withholding to allow the industry to protect themselves given the severity of the vulnerability

RSCs were a mistake. I went back to a client-side only solution using Preact for my latest project because the complexity you buy into is simply not worth the benefit of RSCs.

Are you using Preact Compat or pure Preact? If pure Preact, what are you using for data loading and routing?

I'm using pure Preact and have no need for routing. I keep it very minimalistic and use fetch for data loading, and build my own hooks for state management. I also rolled my own i18n solution this time and I'm quite happy so far.