React 19 useActionState can cause SSR memory leaks and data cross-contamination

·6 views

A technical analysis reveals a critical risk when using React 19's useActionState and server actions in Next.js 15. In server-side rendering, improperly cleaned-up global event listeners can persist in memory across user requests. This can lead to memory leaks and cause one user's data to briefly appear in another user's session. The article advises developers to avoid shared module-level variables and instead scope state to individual request lifecycles using tools like AsyncLocalStorage. It concludes by recommending specific profiling and testing strategies to prevent these issues.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

LayerZero V2 Audit Finds High-Risk Vulnerabilities in Cross-Chain Protocol

A professional audit report dated October 26, 2023, analyzed the high-value LayerZero V2 cross-chain interoperability protocol. The audit found the primary risks exist not in the core messaging layer but in the integration components handling token transfers and liquidity. The main vulnerabilities identified are cross-chain reentrancy attacks and oracle manipulation within the Stargate and OFT contracts. These flaws could potentially lead to double-spending of tokens or draining of protocol liquidity, posing a significant risk given the system's over $11.6 billion in total value locked.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Air-gapped systems offer isolated security but face transfer vulnerabilities

Air-gapped systems are high-security computers or networks physically isolated from external networks like the internet. They are deployed in critical infrastructure, military systems, and sensitive research to prevent remote attacks. This isolation eliminates standard network connections but does not make a system immune to all threats. Security relies heavily on controlled procedures for data transfer, often using removable media, which itself becomes a key vulnerability point.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Five remote job boards prioritize salary transparency for applicants

Several remote job boards now offer features to help applicants find positions with disclosed salaries. Jobicy, We Work Remotely, Remotive, Wellfound, and Working Nomads provide filters or dedicated sections for salary information. These tools allow job seekers to screen for compensation details before applying, saving time in their search. The platforms do not guarantee every listing includes pay information, but they facilitate finding those that do. This transparency addresses a common frustration among applicants who prefer to know salary ranges upfront.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Kubernetes Admission Control Enforces Cluster Policies, Explains Policy Inconsistencies

Admission control is the final enforcement mechanism in the Kubernetes API server, following authentication and authorization. It consists of mutating and validating phases, where webhooks and built-in controllers can modify or reject resource requests. This process explains why identical policies can have different outcomes across clusters, as the order of webhook execution is critical. Tools like Pod Security Admission provide built-in, namespace-level security baselines, while external policy engines like Gatekeeper offer more granular, parameterized rules. The operational success of these systems depends on careful configuration, such as failing securely and managing policy exceptions with clear audit trails.

0 comments Read more at DEV Community