StackPrism

Frontend framework

React: supported versions and open vulnerabilities today

React 19 is supported; 18, 17, 16 and 15 have no announced end-of-life date but no active support; the latest release is 19.3.1. 7 high or critical advisories for React were published in the last 12 months; one advisory (CVE-2025-55182) is on CISA’s list of vulnerabilities exploited in the wild.

Last checked against endoflife.date, npm, OSV.dev, CISA KEV, FIRST EPSS and deps.dev.

Check my repoDesign a stack with React
Latest release
19.3.1
npm downloads last week
188M
GitHub stars
251.1k
Licence
MIT
OpenSSF Scorecard
7 / 10

Supported versions

Data: endoflife.date
React release lines and security support dates from endoflife.date
VersionSecurity supportLatestReleased
React 19Supported: No end date announced19.3.1
React 18No end-of-life date announced: No date announced; active support ended18.3.1
React 17No end-of-life date announced: No date announced; active support ended17.0.2
React 16No end-of-life date announced: No date announced; active support ended16.14.0
React 15No end-of-life date announced: No date announced; active support ended15.7.0

Security advisories

OSV.dev, CISA KEV and FIRST EPSS

8 advisories published in the last 12 months, 7 of them high or critical. 11 in total since records began. Checked packages: react, react-dom, react-server-dom-webpack, react-server-dom-parcel and react-server-dom-turbopack.

  • CriticalCVE-2025-55182Published

    React Server Components are Vulnerable to RCE

    Fixed in 19.0.1, 19.1.2 and 19.2.1.

    Affects react-server-dom-webpack, react-server-dom-parcel and react-server-dom-turbopack.

    Exploited in the wild (CISA)Used in ransomwareEPSS: top 1%
  • HighCVE-2026-44907Published

    react-server-dom: Denial of Service in Server Functions

    Fixed in 19.0.8, 19.1.9 and 19.2.8.

    Affects react-server-dom-webpack, react-server-dom-parcel and react-server-dom-turbopack.

    EPSS: top 53%
  • HighCVE-2026-23870Published

    Facebook React has a Denial of Service Vulnerability in React Server Components

    Fixed in 19.0.6, 19.1.7 and 19.2.6.

    Affects react-server-dom-webpack, react-server-dom-parcel and react-server-dom-turbopack.

    EPSS: top 26%
  • HighCVE-2026-23869Published

    React Server Components have a Denial of Service Vulnerability

    Fixed in 19.0.5, 19.1.6 and 19.2.5.

    Affects react-server-dom-webpack, react-server-dom-parcel and react-server-dom-turbopack.

    EPSS: top 26%
  • HighCVE-2026-23864Published

    React Server Components have multiple Denial of Service Vulnerabilities

    Fixed in 19.0.4, 19.1.5 and 19.2.4.

    Affects react-server-dom-webpack, react-server-dom-parcel and react-server-dom-turbopack.

    EPSS: top 16%
  • HighCVE-2025-67779Published

    Denial of Service Vulnerability in React Server Components

    Fixed in 19.0.3, 19.1.4 and 19.2.3.

    Affects react-server-dom-webpack, react-server-dom-parcel and react-server-dom-turbopack.

    EPSS: top 3%
  • HighCVE-2025-55184Published

    Denial of Service Vulnerability in React Server Components

    Fixed in 19.0.2, 19.1.3 and 19.2.2.

    Affects react-server-dom-webpack, react-server-dom-parcel and react-server-dom-turbopack.

    EPSS: top 1%

All react advisories on OSV.devAll react-dom advisories on OSV.devAll react-server-dom-webpack advisories on OSV.devAll react-server-dom-parcel advisories on OSV.devAll react-server-dom-turbopack advisories on OSV.dev

Maintenance and supply chain

OpenSSF Scorecard 7 / 10 (scored )

The Scorecard rates the repository’s security practices, not known vulnerabilities. Recent activity: 30 commits and 3 issue updates found in the last 90 days.

Weakest checks

  • Unpinned build dependencies (Pinned-Dependencies 0/10)
  • No static analysis (SAST 0/10)
  • No fuzzing (Fuzzing 0/10)

Full ScorecardSource repository

Docs and release notes

Check React in your own stack

This page checks React in general. Your repo pins specific versions: the free dependency check reads your manifests and lists what to fix first. Prism Agent runs the same live checks on your whole stack and turns them into a plan your coding agent can build.

Check my repoDesign a stack with React