Mentioning React Server Components in the status page can be seen as a bad way to shift the blame. Would have been better to not specify which CVE they were trying to patch. The issue is their rollout management, not the Vendor and CVE.
React seems to think that it was React:
https://react.dev/blog/2025/12/03/critical-security-vulnerab...
Next.JS just happens to be the biggest user of this part of React, but blaming Next.JS is weird...
I'm not blaming anyone. Mostly outlining who was impacted as it's not really related to the front-end parts of the framework that the initial comment was referring to.
So now a vuln check for a component deployed on, being generous, 1% of servers causes an outage for 30% of the internet.
The argument is dumb.
It's feels noteworthy because React started out frontend-only, but pedantically it's just another backend with a vulnerability.
I will repeat it because it's so surreal: React (a frontend JS framework) can now bring down critical Internet infrastructure.