Weaponizing And Defending The React Flight Protocol: Deserialization Sinks In RSCs

React Server Components don’t send HTML to your browser. They don’t send JSON either. When a server component renders, what actually travels over the wire is a custom streaming protocol called Flight. It’s a line-delimited format with its own type system, its own reference resolution, and its own rules for reconstructing executable behavior on the client.
Most React developers have never opened the Network tab and actually looked at a Flight payload. It looks like a mix of JSON