React2Shell on TanStack Start?!?

TanStack Start's new React Server Components support does not expose apps to the React2Shell CVE that affects Next.js. Three key reasons explain why: TanStack Start routes server functions to module-specific URLs (not a predictable slash endpoint), only includes server function code when explicitly defined, and uses the Seroval data format instead of React's flight data format. Flight data's object reference traversal mechanism is the root cause of React2Shell, and Seroval avoids this attack vector entirely. Past CVEs against Seroval were permanently fixed without the single-payload attack surface that flight data has.