+
Hello from the server
+
This is a Flight stream served via API route.
+
,
+ )
+})
+
+export const Route = createFileRoute('/api/rsc')({
+ server: {
+ handlers: {
+ GET: async () => {
+ const stream = await getFlightStream()
+ return new Response(stream, {
+ headers: { 'Content-Type': 'text/x-component' },
+ })
+ },
+ },
+ },
+})
+```
+
+And on the client:
+
+```tsx
+import { createFromFetch } from '@tanstack/react-start/rsc'
+
+function GreetingLoader() {
+ const [content, setContent] = React.useState(null)
+
+ React.useEffect(() => {
+ createFromFetch(fetch('/api/greeting')).then(setContent)
+ }, [])
+
+ return content ?? Loading...
+}
+```
+
+This gives you complete control over how RSC content is generated and consumed. Use it for custom caching layers, WebSocket-based streaming, or anything else the high-level helpers don't cover.
+
+---
+
+## Security: One-Way Data Flow
+
+Let's talk about something important. You may have seen recent CVEs affecting RSC implementations in other frameworks. Here's why TanStack Start isn't vulnerable to those same issues.
+
+The core difference is simple: **TanStack Start's server functions don't accept or parse incoming Flight data.** Payloads flow in one direction only: server to client.
+
+Other RSC implementations use the `'use server'` directive to create Server Actions that parse Flight data sent _from_ the client. That bidirectional flow is where the vulnerabilities live. When your server parses untrusted Flight payloads, you're exposed to deserialization attacks and prototype pollution.
+
+We took a fundamentally different approach. TanStack Start uses `createServerFn` for server functions. These are regular functions that receive JSON input, validate it with your middleware, and return data. They don't accept Flight streams. They don't parse React's wire format from untrusted sources.
+
+The result: server-rendered RSC content streams to your client, but the client never sends Flight data back. No parsing of untrusted RSC payloads means no exposure to those attack vectors.
+
+That said, treat your server functions like any API surface: authenticate requests, validate inputs, and keep React patched. Security is always defense in depth. But you can use Composite Components knowing they aren't susceptible to the same class of vulnerabilities that have affected other frameworks.
+
+---
+
+## The Full Spectrum
+
+With RSCs as primitives, TanStack Start covers every frontend use case. And we mean _every_:
+
+- **Fully Interactive**
+ No server components at all. Client-first, SPA-style. RSCs are an optimization you add when helpful, not a paradigm you're forced to build around.
+
+- **Hybrid**
+ Server components for static shells, data-heavy regions, or SEO-critical content. Slots for interactivity. Mix freely within the same component. This is where most apps will land.
+
+- **Fully Static**
+ Pre-render everything at build time. No hydration, no JavaScript. Just ship HTML.
+
+**One framework. One mental model. The entire spectrum.**
+You don't have to choose "interactive framework" or "static framework" or "RSC framework."
+You choose patterns **per-route, per-component, per-use-case**. The architecture supports all of it. Because, again, you know what's best for your app.
+
+---
+
+## Current Status: Experimental
+
+RSC support is experimental in TanStack Start RC and will remain experimental into early v1.
+
+**Serialization:** This release uses React's native Flight protocol. TanStack Start's usual serialization features aren't available within server components for now.
+
+**API surface:** The `createCompositeComponent`, `renderToReadableStream`, and related APIs are stable in design but may see refinements.
+
+If you hit rough edges, [open an issue](https://github.com/tanstack/router/issues) or join the [Discord](https://tlinz.com/discord).
+
+---
+
+## FAQ
+
+We get questions. Here are answers.
+
+### How does this compare to Next.js App Router?
+
+Next.js App Router is server-first: your component tree lives on the server by default, and you opt into client interactivity with `'use client'`.
+
+TanStack Start is **isomorphic-first**: your tree lives wherever makes sense. The key difference is **client-led composition**. Composite Components expose slots so the client assembles the final tree. You're in control.
+
+### Can I use this with Next.js or Remix?
+
+Not directly—TanStack Start is its own framework. But if you use TanStack Query or Router already, the mental model transfers.
+
+### Do I have to use RSCs?
+
+Nope. RSCs are completely opt-in. You can build fully client-side routes (including `ssr: false`), use traditional SSR without server components, or go fully static.
+
+Composite Components are just another primitive. They compose with Start features like Selective SSR and with TanStack Query and Router caching, instead of replacing them.
+
+### What about React 19 and Server Actions?
+
+TanStack Start uses React's Flight protocol and works with React 19. `createServerFn` serves a similar purpose to Server Actions but integrates with TanStack's middleware, validation, and caching. We're watching the Server Actions API and will align where it makes sense.
+
+### Can I define components outside the RSC helpers?
+
+Yes. Define your component separately and invoke it inside `createCompositeComponent` or `renderToReadableStream`. The helpers just initiate the RSC stream—they don't care where your JSX comes from.
+
+### Can I return raw JSX without the RSC helpers?
+
+No. `renderToReadableStream` and `createCompositeComponent` enable streaming, slot handling, and client rehydration. Plain JSX from a server function won't have RSC behavior.
+
+### Do `cloneElement` and React Context work with server component children?
+
+**cloneElement:** No—client children are slot placeholders. The server can't inspect or clone them. (This is actually a feature, not a bug. It keeps the model predictable.)
+
+**React Context:** Yes! Providers in server components wrap client children just fine. The context must work across the boundary (typically `'use client'` on the provider component).
+
+### What about security?
+
+See the [Security: One-Way Data Flow](#security-one-way-data-flow) section above. The short version: TanStack Start's architecture doesn't parse Flight data from the client, so recent CVEs affecting other RSC frameworks don't apply here.
+
+---
+
+## Your RSCs, Your Way
+
+We started this post with a simple idea: you know what's best for your application architecture. That's why we built the low-level API and Composite Components the way we did.
+
+Other frameworks tell you how RSCs have to work. We give you primitives and let you decide. Want a fully interactive SPA? Go for it. Want to sprinkle in server components for heavy lifting? Easy. Want to go full static? That works too. The architecture supports all of it because _your_ app isn't one-size-fits-all, and your framework shouldn't be either.
+
+TanStack Start's RSC model is available now as an experimental feature. We're excited to see what you build with it.
+
+- [Documentation](https://tanstack.com/start)
+- [GitHub](https://github.com/tanstack/router)
+- [Discord](https://tlinz.com/discord)
+
+Let's build something amazing together.