Is react-dom 16.4 vulnerable?

npm · 3 releases from 16.4.0 to 16.4.2 · latest react-dom is 19.3.1 · checked 2 Nov 2026

No known advisories in the last release

react-dom 16.4.2, the last 16.4 release, has no known advisories. 1 advisory affects earlier 16.4.x releases, so update to 16.4.2.

Update within 16.4:npm install react-dom@16.4.2

Is your project affected?

Private repo? Upload its lockfile instead, or connect GitHub to check every repo.

Fixed within 16.4.x, affecting earlier releases

  • MediumCVE-2018-6341GHSA-mvjj-gqq2-p4hw4 Jan 2019

    Cross-Site Scripting in react-dom

    Affected
    >=16.0.0 <16.0.1 · >=16.1.0 <16.1.2 · >=16.2.0 <16.2.1 · >=16.3.0 <16.3.3 · >=16.4.0 <16.4.2
    Fixed in
    16.0.1, 16.1.2, 16.2.1, 16.3.3, 16.4.2

Which of your client projects are still on react-dom 16.4?

NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact react-dom version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

Other react-dom versions

Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.