StackPrism

npm package

react vulnerabilities by version

The latest release, 19.3.1 (Oct 14, 2026), has no known vulnerabilities. 0% of last week’s 188M downloads went to versions with known vulnerabilities. OSV.dev lists 2 advisories for react; the newest was published on Sep 4, 2020.

npm (opens in a new tab) describes it as “React is a JavaScript library for building user interfaces.”

Latest release
19.3.1
Oct 14, 2026, no known vulnerabilities
Downloads last week
188M
All versions, from npm
Advisories on OSV.dev
2
Newest Sep 4, 2020
Licence
MIT

Most-downloaded versions last week

From npm’s per-version download counts for the last 7 days, each checked against OSV.dev. Open a version for its advisories and what to upgrade to.

VersionKnown vulnerabilitiesDownloads
19.3.0Sep 9, 2026No known vulnerabilities41.7M
18.3.1Apr 26, 2024No known vulnerabilities36.9M
19.2.8Jul 21, 2026No known vulnerabilities28.5M
19.2.4Jan 26, 2026No known vulnerabilities14.4M
19.2.7Jun 1, 2026No known vulnerabilities13.3M
19.2.3Dec 11, 2025No known vulnerabilities12.8M
19.2.6May 6, 2026No known vulnerabilities6.9M
19.2.5Apr 8, 2026No known vulnerabilities6.7M

Who is still on a vulnerable react

0% of last week’s 188M react downloads went to versions with known vulnerabilities.

From npm’s per-version download counts for the last 7 days, each version checked against OSV.dev. The versions checked cover over 99% of downloads.

Release lines

Support dates from endoflife.date (opens in a new tab). A line past its end date gets no more security fixes.

LineLatestSecurity support
1919.3.1No end date announced
1818.3.1No end date announced
1717.0.2No end date announced
1616.14.0No end date announced
1515.7.0No end date announced

Newest advisories

The 2 most recently published, with the versions each one affects.

  1. WarningCVE-2013-7035 on OSV.dev (opens in a new tab)GHSA-g53w-52xc-2j85

    Cross-Site Scripting in react

    Affects >= 0.4.0, < 0.4.2; >= 0.5.0, < 0.5.2. Published Sep 4, 2020.

  2. CriticalGHSA-hg79-j56m-fxgv on OSV.dev (opens in a new tab)

    Cross-Site Scripting in react

    Affects >= 0.0.1, < 0.14.0. Published Sep 4, 2020.

Which react do you have?

Paste a public GitHub repo or drop your package.json and see every vulnerable, end-of-life or deprecated dependency, with one fix task for your coding agent. Free, no sign-up.

Check your whole repo

How this page is checked

StackPrism reads every OSV.dev advisory for react, merges duplicates filed under several ids, and asks OSV.dev which ones affect each version listed. Releases and their dates come from deps.dev, downloads from npm, support dates from endoflife.date. No AI writes this page: every sentence comes from that data, refreshed every few hours.

Last checked against OSV.dev, CISA KEV, npm, deps.dev and endoflife.date.