Is your React version vulnerable?
React release lines today
React’s newest release lines, their support status from endoflife.date, and whether the newest release in each line has known advisories in React or its Server Components packages today.
| Line | Support | Newest release | Advisories in it |
|---|---|---|---|
| React 19 | Supported | 19.3.1 | None known |
| React 18 | Supported | 18.3.1 | None known |
| React 17 | Supported | 17.0.2 | None known |
| React 16 | Supported | 16.14.0 | None known |
| React 15 | Supported | 15.7.0 | None known |
React 1919.3.1
Supported
Advisories in the newest release: None known
React 1818.3.1
Supported
Advisories in the newest release: None known
React 1717.0.2
Supported
Advisories in the newest release: None known
React 1616.14.0
Supported
Advisories in the newest release: None known
React 1515.7.0
Supported
Advisories in the newest release: None known
Last checked against endoflife.date, npm, OSV.dev and deps.dev.
Why the react package rarely has advisories
The react and react-dom packages render your components. The code that turns a network request into a call on your server lives in the React Server Components packages: react-server-dom-webpack, react-server-dom-parcel and react-server-dom-turbopack. That’s where React2Shell was, and where the denial-of-service and source-exposure fixes since then landed. A check of react alone would miss all of them.
These packages ship with the same version numbers as React, so for React 19 we check each of them at your React version.
Does it apply to your app?
- Yes, if React Server Components run on your server: Next.js with the App Router (check your Next.js version instead, since Next.js bundles its own React), React Router’s RSC mode, Waku, @parcel/rsc, @vitejs/plugin-rsc or rwsdk.
- No, if React only runs in the browser or as a static export: the Server Components advisories need a server.
- To check a whole repo or package.json for React2Shell specifically, use the React2Shell checker.
Questions
Is React 18 affected by React2Shell?
No. The advisory lists react-server-dom-webpack, -parcel and -turbopack 19.0.0, 19.1.0, 19.1.1 and 19.2.0 only, and the stable releases of those packages start at 19.0.0.
I only use React in the browser. Am I affected?
Not by the React Server Components advisories: they need a server that runs React Server Components. A client-only app, such as a Vite single-page app, doesn’t.
Should react and react-dom be on the same version?
Yes. They’re released together and expected to match, so upgrade them together, along with any react-server-dom package you use.
How do I find my React version?
Run npm ls react react-dom in the project. For a Next.js app, check your Next.js version instead: Next.js bundles its own React.
Go further than one check
Map your repo into an architecture diagram with live health on every part, get an alert when a new critical finding lands, and hand your coding agent a brief to build from. Free to start.