React vulnerabilities and fixes

CVEs that mention React, ranked by priority. 25 tracked.

React has 25 tracked vulnerabilities, 6 critical. A fixed release or vendor patch exists for 21. Most recent: 2026-10-23. Highest priority: CVE-2026-35052 (score 54/100).

• CVE-2026-35052 CRITICAL 9.8 UPGRADE D-Tale is the combination of a Flask back-end and a React front-end to view & analyze Pandas data structures
• CVE-2026-48158 CRITICAL 9.3 use-context-selector is a React useContextSelector hook in userland Between 2026-05-18 15:57:18 and 2026-05-19
• CVE-2026-48159 CRITICAL 9.3 use-reducer-async is a React useReducer with async actions
• CVE-2026-48160 CRITICAL 9.3 react-tracked provides state usage tracking with Proxies
• CVE-2026-18245 CRITICAL 9.0 UPGRADE Improper control of code generation in Amazon @aws-amplify/codegen-ui-react before 2.20.6 might allow a remote
• CVE-2026-48161 CRITICAL 9.3 react18-use is a React 19 use hook shim
• CVE-2026-64641 HIGH 7.5 UPGRADE Next.js is a React framework for building full-stack web applications
• CVE-2026-64642 HIGH 8.2 UPGRADE Next.js is a React framework for building full-stack web applications
• CVE-2026-55685 HIGH 7.5 UPGRADE React Router is a router for React
• CVE-2026-94482 HIGH 8.2 Next.js is a React framework for building full-stack web applications
• CVE-2026-64649 MEDIUM 6.5 UPGRADE Next.js is a React framework for building full-stack web applications
• CVE-2026-64644 MEDIUM 5.3 UPGRADE Next.js is a React framework for building full-stack web applications
• CVE-2026-64643 MEDIUM 5.3 UPGRADE Next.js is a React framework for building full-stack web applications
• CVE-2026-64646 MEDIUM 5.3 UPGRADE Next.js is a React framework for building full-stack web applications
• CVE-2026-53667 MEDIUM 6.9 UPGRADE React Router is a router for React
• CVE-2026-53668 MEDIUM 6.9 UPGRADE React Router is a router for React
• CVE-2026-53666 MEDIUM 6.1 UPGRADE React Router is a router for React
• CVE-2026-64645 MEDIUM 6.1 UPGRADE Next.js is a React framework for building full-stack web applications
• CVE-2026-53669 MEDIUM 6.1 UPGRADE React Router is a router for React
• CVE-2026-64647 MEDIUM 5.4 UPGRADE Next.js is a React framework for building full-stack web applications
• CVE-2026-64648 MEDIUM 5.4 UPGRADE Next.js is a React framework for building full-stack web applications
• CVE-2026-73155 MEDIUM 5.3 Affected versions of cti-transmute allow authenticated users to add or remove emoji reactions on comments with
• CVE-2026-18648 MEDIUM 5.3 A vulnerability was detected in Blix Email Blue Mail Calendar App 2.2.305
• CVE-2026-19323 MEDIUM 5.3 A security flaw has been discovered in azer react-analyzer-mcp up to 335f2a3585f265e2e88352b59b10d3b478d678b0
• CVE-2026-55422 MEDIUM 4.6 conda-forge is a GitHub organization containing repositories of conda recipes

FAQ

How do I fix React vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is React being exploited right now?

None of the tracked React CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which React CVE should I patch first?

CVE-2026-35052 currently ranks highest (54/100): D-Tale is the combination of a Flask back-end and a React front-end to view & analyze Pandas data structures.

← Back to latest CVEs