Thanks to everyone who made this release possible!
For a full list of changes, see the changelog:
github.com/react/react/...
For a full list of changes, see the changelog:
github.com/react/react/...
react/CHANGELOG.md at main · react/react
The library for web and native user interfaces. Contribute to react/react development by creating an account on GitHub.
github.com
September 9, 2026 at 7:21 PM
Thanks to everyone who made this release possible!
For a full list of changes, see the changelog:
github.com/react/react/...
For a full list of changes, see the changelog:
github.com/react/react/...
browser() is a new API for components that depend on the browser.
Calling use(browser()) suspends during server rendering, so React can show the nearest Suspense fallback and continue rendering the component on the client.
react.dev/reference/re...
Calling use(browser()) suspends during server rendering, so React can show the nearest Suspense fallback and continue rendering the component on the client.
react.dev/reference/re...
browser – React
The library for web and native user interfaces
react.dev
September 9, 2026 at 7:21 PM
browser() is a new API for components that depend on the browser.
Calling use(browser()) suspends during server rendering, so React can show the nearest Suspense fallback and continue rendering the component on the client.
react.dev/reference/re...
Calling use(browser()) suspends during server rendering, so React can show the nearest Suspense fallback and continue rendering the component on the client.
react.dev/reference/re...
Fragment Refs are now stable.
Pass a ref to to work with its DOM children as a group, without adding a wrapper element. FragmentInstance includes APIs for events, focus, observers, measurement, and scrolling.
react.dev/reference/re...
Pass a ref to
react.dev/reference/re...
<Fragment> (<>...</>) – React
The library for web and native user interfaces
react.dev
September 9, 2026 at 7:21 PM
Fragment Refs are now stable.
Pass a ref to to work with its DOM children as a group, without adding a wrapper element. FragmentInstance includes APIs for events, focus, observers, measurement, and scrolling.
react.dev/reference/re...
Pass a ref to
react.dev/reference/re...
It can animate UI as it enters, exits, or updates. Transitions, Suspense reveals, and deferred updates can trigger the animation.
react.dev/reference/re...
<ViewTransition> – React
The library for web and native user interfaces
react.dev
September 9, 2026 at 7:21 PM
It can animate UI as it enters, exits, or updates. Transitions, Suspense reveals, and deferred updates can trigger the animation.
react.dev/reference/re...
React 19.3 is now available!
This release makes View Transitions and Fragment Refs stable, and adds browser(), Trusted Types support, and Context in Server Components.
react.dev/blog/2026/09...
This release makes View Transitions and Fragment Refs stable, and adds browser(), Trusted Types support, and Context in Server Components.
react.dev/blog/2026/09...
React 19.3 – React
The library for web and native user interfaces
react.dev
September 9, 2026 at 7:21 PM
React 19.3 is now available!
This release makes View Transitions and Fragment Refs stable, and adds browser(), Trusted Types support, and Context in Server Components.
react.dev/blog/2026/09...
This release makes View Transitions and Fragment Refs stable, and adds browser(), Trusted Types support, and Context in Server Components.
react.dev/blog/2026/09...
The React Foundation has officially launched, hosted by the Linux Foundation. Read more here: react.dev/blog/2026/02...
February 24, 2026 at 9:01 PM
The React Foundation has officially launched, hosted by the Linux Foundation. Read more here: react.dev/blog/2026/02...
We found that the fix to address the DoS vulnerability in React Server Components (CVE-2025-55184) was incomplete and does not prevent an attack in a specific case.
This is disclosed as CVE-2025-67779. New patches are available now, please update immediately.
This is disclosed as CVE-2025-67779. New patches are available now, please update immediately.
December 12, 2025 at 12:04 AM
We found that the fix to address the DoS vulnerability in React Server Components (CVE-2025-55184) was incomplete and does not prevent an attack in a specific case.
This is disclosed as CVE-2025-67779. New patches are available now, please update immediately.
This is disclosed as CVE-2025-67779. New patches are available now, please update immediately.
These issues are present in the patches published last week for React2Shell. Even though they do not allow for Remote Code Execution they are high severity and you should update (again) immediately.
react.dev/blog/2025/12...
react.dev/blog/2025/12...
Denial of Service and Source Code Exposure in React Server Components – React
The library for web and native user interfaces
react.dev
December 11, 2025 at 8:51 PM
These issues are present in the patches published last week for React2Shell. Even though they do not allow for Remote Code Execution they are high severity and you should update (again) immediately.
react.dev/blog/2025/12...
react.dev/blog/2025/12...
This pattern shows up across the industry, not just in JavaScript. For example, after Log4Shell, additional CVEs were reported as the community examined the original fix.
Additional disclosures can be frustrating, but they are generally a sign of a healthy response cycle.
Additional disclosures can be frustrating, but they are generally a sign of a healthy response cycle.
December 11, 2025 at 8:51 PM
This pattern shows up across the industry, not just in JavaScript. For example, after Log4Shell, additional CVEs were reported as the community examined the original fix.
Additional disclosures can be frustrating, but they are generally a sign of a healthy response cycle.
Additional disclosures can be frustrating, but they are generally a sign of a healthy response cycle.
It’s common for critical CVEs to uncover follow‑up vulnerabilities. When a critical vulnerability is disclosed, researchers scrutinize adjacent code paths looking for variant exploit techniques to test whether the initial mitigation can be bypassed.
December 11, 2025 at 8:51 PM
It’s common for critical CVEs to uncover follow‑up vulnerabilities. When a critical vulnerability is disclosed, researchers scrutinize adjacent code paths looking for variant exploit techniques to test whether the initial mitigation can be bypassed.
We disclosed two new RSC vulnerabilities:
- Denial of Service (High): CVE-2025-55184
- Source Code Exposure (Medium): CVE-2025-55183
Patches are available now, please update immediately.
react.dev/blog/2025/12...
- Denial of Service (High): CVE-2025-55184
- Source Code Exposure (Medium): CVE-2025-55183
Patches are available now, please update immediately.
react.dev/blog/2025/12...
Denial of Service and Source Code Exposure in React Server Components – React
The library for web and native user interfaces
react.dev
December 11, 2025 at 8:51 PM
We disclosed two new RSC vulnerabilities:
- Denial of Service (High): CVE-2025-55184
- Source Code Exposure (Medium): CVE-2025-55183
Patches are available now, please update immediately.
react.dev/blog/2025/12...
- Denial of Service (High): CVE-2025-55184
- Source Code Exposure (Medium): CVE-2025-55183
Patches are available now, please update immediately.
react.dev/blog/2025/12...
Researchers have found two new vulnerabilities in React Server Components while attempting to exploit the patches last week.
These are new issues, separate from the critical CVE last week. The patch for React2Shell remains effective for the Remote Code Execution exploit.
These are new issues, separate from the critical CVE last week. The patch for React2Shell remains effective for the Remote Code Execution exploit.
December 11, 2025 at 8:51 PM
Researchers have found two new vulnerabilities in React Server Components while attempting to exploit the patches last week.
These are new issues, separate from the critical CVE last week. The patch for React2Shell remains effective for the Remote Code Execution exploit.
These are new issues, separate from the critical CVE last week. The patch for React2Shell remains effective for the Remote Code Execution exploit.
Reposted by React
There is critical vulnerability in React Server Components disclosed as CVE-2025-55182 that impacts React 19 and frameworks that use it.
A fix has been published in React versions 19.0.1, 19.1.2, and 19.2.1. We recommend upgrading immediately.
react.dev/blog/2025/12...
A fix has been published in React versions 19.0.1, 19.1.2, and 19.2.1. We recommend upgrading immediately.
react.dev/blog/2025/12...
Critical Security Vulnerability in React Server Components – React
The library for web and native user interfaces
react.dev
December 3, 2025 at 3:45 PM
There is critical vulnerability in React Server Components disclosed as CVE-2025-55182 that impacts React 19 and frameworks that use it.
A fix has been published in React versions 19.0.1, 19.1.2, and 19.2.1. We recommend upgrading immediately.
react.dev/blog/2025/12...
A fix has been published in React versions 19.0.1, 19.1.2, and 19.2.1. We recommend upgrading immediately.
react.dev/blog/2025/12...
There is critical vulnerability in React Server Components disclosed as CVE-2025-55182 that impacts React 19 and frameworks that use it.
A fix has been published in React versions 19.0.1, 19.1.2, and 19.2.1. We recommend upgrading immediately.
react.dev/blog/2025/12...
A fix has been published in React versions 19.0.1, 19.1.2, and 19.2.1. We recommend upgrading immediately.
react.dev/blog/2025/12...
Critical Security Vulnerability in React Server Components – React
The library for web and native user interfaces
react.dev
December 3, 2025 at 3:45 PM
There is critical vulnerability in React Server Components disclosed as CVE-2025-55182 that impacts React 19 and frameworks that use it.
A fix has been published in React versions 19.0.1, 19.1.2, and 19.2.1. We recommend upgrading immediately.
react.dev/blog/2025/12...
A fix has been published in React versions 19.0.1, 19.1.2, and 19.2.1. We recommend upgrading immediately.
react.dev/blog/2025/12...
React Conf 2025 is a wrap! Check out the recap: react.dev/blog/2025/10...
React Conf 2025 Recap – React
The library for web and native user interfaces
react.dev
October 16, 2025 at 9:42 PM
React Conf 2025 is a wrap! Check out the recap: react.dev/blog/2025/10...
Join the Discord to chat with fellow attendees and submit your questions for speakers to answer on the livestream: discord.gg/reactconf
Join the React Conf 2025 Discord Server!
Offical React Conf 2025 Discord Server | 1028 members
discord.gg
October 8, 2025 at 4:33 PM
Join the Discord to chat with fellow attendees and submit your questions for speakers to answer on the livestream: discord.gg/reactconf
Watch the livestream at conf.react.dev or YouTube www.youtube.com/watch?v=p9Oc...
React Conf 2025 Day 2
YouTube video by React Conf
www.youtube.com
October 8, 2025 at 4:33 PM
Watch the livestream at conf.react.dev or YouTube www.youtube.com/watch?v=p9Oc...
React Conf Day 2 is starting now!
October 8, 2025 at 4:33 PM
React Conf Day 2 is starting now!
Read more here: react.dev/blog/2025/10...
Introducing the React Foundation – React
The library for web and native user interfaces
react.dev
October 7, 2025 at 5:33 PM
Read more here: react.dev/blog/2025/10...
Introducing the React Foundation
October 7, 2025 at 5:33 PM
Introducing the React Foundation
Join the Discord to chat with fellow attendees and submit your questions for speakers to answer on the livestream: discord.gg/reactconf
Join the React Conf 2025 Discord Server!
Offical React Conf 2025 Discord Server | 628 members
discord.gg
October 7, 2025 at 4:02 PM
Join the Discord to chat with fellow attendees and submit your questions for speakers to answer on the livestream: discord.gg/reactconf
Watch the livestream at conf.react.dev or YouTube www.youtube.com/watch?v=zyVR...
React Conf 2025 Day 1
YouTube video by React Conf
www.youtube.com
October 7, 2025 at 4:02 PM
Watch the livestream at conf.react.dev or YouTube www.youtube.com/watch?v=zyVR...
We are excited to announce @infinite.red, Old Mission, @arcjet.com, and @renderatl.com as React Conf silver sponsors this year!
October 6, 2025 at 9:21 PM
We are excited to announce @infinite.red, Old Mission, @arcjet.com, and @renderatl.com as React Conf silver sponsors this year!
We are excited to announce @mux.com as the React Conf livestream sponsor this year! Learn about how to build better video into websites, platforms, AI workflows, and more here: www.mux.com
Video API for developers | Mux
Mux helps teams ship high-performance and cost-effective video in minutes, not months. Build better video into anything from websites to platforms to AI workflows.
www.mux.com
October 6, 2025 at 8:57 PM
We are excited to announce @mux.com as the React Conf livestream sponsor this year! Learn about how to build better video into websites, platforms, AI workflows, and more here: www.mux.com