react-dom

Security advisories

Grouped by the version that fixes them, so one upgrade reads as one step.

• Fixed in 16.4.2 · 1 advisory

  • MODERATECross-Site Scripting in react-domGHSA-mvjj-gqq2-p4hw

Every stable release, newest first. Notes are quoted as the maintainers published them.

1. 19.1.10

   14 October 2026
   Improve transport protocol

   React Server Components

   • Improve transport protocol

2. 19.0.9

   14 October 2026
   Improve transport protocol

   React Server Components

   • Improve transport protocol

3. 19.2.9

   14 October 2026
   Improve transport protocol

   React Server Components

   • Improve transport protocol

4. 19.3.1

   14 October 2026
   Improve transport protocol

   React Server Components

   • Improve transport protocol

5. 19.3.0

   9 September 2026
   Below is a list of all new features, APIs, and bug fixes.

   Below is a list of all new features, APIs, and bug fixes.

   Read the React 19.3 release post for more information.

   New React Features

   • <ViewTransition />: Adds <ViewTransition /> and addTransitionType APIs to power View Transition animations in React (@sebmarkbage, @jackpope, @gaearon: #31975, #31987, #31996, #31999, #32001, #32002, #32028, #32029, #32031, #32034, #32038, #32041, #32050, #32090, #32105, #32254, #32379, #32422, #32462, #32540, #32545, #32585, #32599, #32611, #32612, #32617, #32651, #32653, #32656, #32664, #32699, #32723, #32734, #32751, #32752, #32760, #32761, #32764, #32772, #32790, #32819, #32820, #32822, #32833, #32849, #33094, #33191, #33200, #33206, #33293, #33330, #33331, #33332, #33357, #33362, #33433, #33576, #34374, #34450, #34481, #34500, #34502, #34510, #34511, #34539, #35567, #35564, #35485, #35380, #35063, #35060, #34676, #36917, #35337, #35520)

   • Fragment Refs: Add Refs to <Fragment /> to support composable platform behavior (@jackpope, @sebmarkbage, @eps1lon, @Dhakshin2007, @chirokas, @teamleaderleo, @fallintoplace: #32465, #32613, #32619, #32654, #32660, #32682, #32722, #32813, #32814, #33056, #33058, #33093, #34069, #34103, #34544, #34545, #37062, #37061, #37060, #36047, #36010, #35642, #35641, #35637, #35630, #34935, #37457, #37408, #37326, #37251, #37171, #37169, #37168, #37167, #37166, #37165, #37164, #37163, #37162, #37161, #37160, #37125, #37063)

   New React DOM Features

   • browser(): a new react-dom API that returns a usable which errors during server rendering and resolves in the browser. use(browser()) inside a <Suspense> boundary marks a subtree as browser-only without reporting a recoverable error (@gnoff: #37143, #37241)

     • Added an onBrowserBailout option to the react-dom/server APIs to observe when a subtree defers to the browser (@gnoff #37193)

   Notable changes

   • Enable Trusted Types API integration (@rickhanlonii #35816)

   • Transitions now render independently instead of being entangled into a single render, so a slow transition no longer holds up unrelated ones (@acdlite #37290)

   • Added a DEV-only warning when a component appears to have been unblocked by calling use() conditionally (@hoxyq, @eps1lon: #37104, #37203, #37491)

   All Changes

   React

   • Fast Refresh Fixes

     • Fix Fast Refresh to find and remount edits to components wrapped behind lazy() (@sophiebits #36965)

     • Fix Fast Refresh so edits to a memo() comparison function take effect (@sophiebits #36964)

     • Fix Fast Refresh crash when an edit changes the kind of a component's type (@sophiebits #36963)

     • Unify hot reload type resolution for Fast Refresh (@sophiebits #36962)

     • Fix Fast Refresh to remount correctly when an edit changes the component kind (@sophiebits #36950)

     • Double invoke effects in StrictMode after Fast Refresh (@eps1lon #35962)

   • Performance Track Fixes

     • Prevent crash when accessing $$typeof in Performance Tracks (@eps1lon #35679)

     • Handle non-string function names in Performance Tracks (@eps1lon #35659)

     • Use minus (-) instead of en dash for removed props in Performance Tracks (@eps1lon #35649)

     • Handle arrays with bigints in deep objects in Performance Tracks (@eps1lon #35648)

     • Don't enumerate typed array props in Performance Tracks in DEV (@UditDewan #36913)

     • Bail out of diffing wide objects and arrays in Performance Tracks (@eps1lon #34742)

     • Clear potentially large performance measures in DEV (@hoxyq #34803)

     • Fix missing else branch for renders with no props change in Performance Tracks (@hoxyq #34837)

   • Activity Fixes

     • Fix useSyncExternalStore missing store mutations that happened while an Activity tree was hidden (@sophiebits #36947)

     • Hide portal contents when an Activity is hidden (@acdlite #35091)

     • Prevent metadata hoisting in hidden <Activity> trees (@ronnakamoto #34983)

     • Prevent errors thrown inside a hidden Activity from escaping to the visible UI (@acdlite #35074)

     • Don't unhide a node if a direct parent Offscreen is still hidden (@sebmarkbage #34821)

     • Don't show internal <Offscreen> component in error messages (@rickhanlonii #35763)

   • Warn in DEV when a component appears to have been unblocked by a conditional use() (@hoxyq, @eps1lon: #37104, #37203, #37491)

   • Render transitions independently instead of entangling them into a single render (@acdlite #37290)

   • Fix hang when updating a dehydrated boundary inside a hidden tree (@gaearon #37135)

   • Don't reacquire Host Singletons during dev effect validation (@gnoff #37113)

   • Only remove properties from Host Singletons on release (@gnoff #37112)

   • Don't invoke effects on moved children in StrictMode (@sophiebits #36948)

   • Throw a clearer error when a rejected Promise is incorrectly instrumented (@eps1lon #36328)

   • Fix context propagation into Suspense fallbacks (@acdlite #36160)

   • Fix context propagation through suspended Suspense boundaries (@acdlite #35839)

   • Fix useDeferredValue getting stuck (@gaearon #36134)

   • Update useActionState error message to say "action state" instead of "form state" (@rickhanlonii #35790)

   • Don't warn when rendering data block scripts (@eps1lon #35953)

   • Treat fibers with alternates as mounted in getNearestMountedFiber (@sebmarkbage #35578)

6. 19.0.8

   21 July 2026
   Performance improvements when decoding

   React Server Components

   • Performance improvements when decoding

7. 19.1.9

   21 July 2026
   Performance improvements when decoding

   React Server Components

   • Performance improvements when decoding

8. 19.2.8

   21 July 2026
   Performance improvements when decoding

   React Server Components

   • Performance improvements when decoding

Major versions

• 19.xsince 5 December 2024 · latest 19.3.1 · 33 releases
• 18.xsince 29 March 2022 · latest 18.3.1 · 5 releases
• 17.xsince 20 October 2020 · latest 17.0.2 · 3 releases
• 16.xsince 26 September 2017 · latest 16.14.0 · 38 releases
• 15.xsince 7 April 2016 · latest 15.7.0 · 21 releases
• 0.xsince 6 May 2014 · latest 0.14.10 · 12 releases