react-dom (npm)

The library for web and native user interfaces.

Advisories

Latest version

19.3.1

Released Oct 14, 2026

License

MIT

OpenSSF Scorecard

—

How to fix

Upgrading to 16.4.2 or later clears every advisory below that has a fix.

Upgrade commands

npm

npm install react-dom@19.3.1

yarn

yarn add react-dom@19.3.1

pnpm

pnpm add react-dom@19.3.1

Known vulnerabilities

Advisory	Severity	Affected	Fixed in
GHSA-mvjj-gqq2-p4hw Cross-Site Scripting in react-dom	Medium EPSS 3.43%	`>= 16.0.0, < 16.0.1`	`16.0.1`
GHSA-mvjj-gqq2-p4hw Cross-Site Scripting in react-dom	Medium EPSS 3.43%	`>= 16.1.0, < 16.1.2`	`16.1.2`
GHSA-mvjj-gqq2-p4hw Cross-Site Scripting in react-dom	Medium EPSS 3.43%	`>= 16.2.0, < 16.2.1`	`16.2.1`
GHSA-mvjj-gqq2-p4hw Cross-Site Scripting in react-dom	Medium EPSS 3.43%	`>= 16.3.0, < 16.3.3`	`16.3.3`
GHSA-mvjj-gqq2-p4hw Cross-Site Scripting in react-dom	Medium EPSS 3.43%	`>= 16.4.0, < 16.4.2`	`16.4.2`

Source: git+https://github.com/react/react.git

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor