react
19.3.1 · 14 Oct 2026MIT116.2M / weekRepositoryHomepagenpmAtom feed
Security advisories
From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.
Is your project affected?
Paste your package.json, or type the range you declare for react. It is read in your browser and sent nowhere.
| Line | Newest | Where it stands |
|---|---|---|
| 19.3.1 | No known advisory | |
| 0.13.3 | 13 open advisories, worst high · last release May 2015, no longer updated |
- HighCross-Site Scripting in reactGHSA-hg79-j56m-fxgv · 4 Sep 2020
- 0.13.x and older0.0.1 – 0.13.3No fix, no longer updated
- ModerateCross-Site Scripting in reactGHSA-g53w-52xc-2j85 · 4 Sep 2020
- 0.5.x0.5.0 – 0.5.1Fixed in 0.5.2
Quality and security signals
What npm and deps.dev say about the latest release. Signals, not a verdict.
- Licence
- ProvenancePresent, built from github.com/react/reactSays where the release was built and from which commit. It does not say the code is safe.
- Published byGitHub Actions
- Maintainers on npm
- Size
- GitHub stars251,401 on react/react
- Last release19.3.1, 14 October 2026
- OpenSSF ScorecardNo Scorecard for this repository
Registry facts last checked 21 Oct 2026. Releases and advisories last read 21 Oct 2026.