Hacker News Reader

”use server” is not required for this vulnerability to be exploitable.

wait I'm only using React for SPA (no server rendering)

am I also vulnerable??????

Only if you are running a vulnerable version of Next.js server.

No, unless you run the React Server Component runtime on your server, which you wouldn't do with a SPA, you would just serve a static bundle.