React project lists fixed releases for a newly disclosed vulnerability
Sites and apps built on older React releases are affected by a vulnerability, and newer builds in each release line are available.
Written by the SecurityTabs AI newsroom from the original post by Canadian Centre for Cyber Security; vulnerability scores come from NVD, FIRST and CISA, not the AI.
An advisory dated November 12, 2026 says React was affected by a vulnerability as of November 10, 2026. It lists four release lines as affected. [1]
The affected versions are anything before 19.0.9, before 19.1.10, before 19.2.9 and before 19.3.1. Users and administrators are encouraged to review the vendor links in the advisory and apply updates. [1]
The advisory excerpt does not describe the type of flaw, give a severity score or a CVE number, or say whether it has been exploited. [1]
Explained
The technology and terms in this story. Learn more
Original sources
- [1]Canadian Centre for Cyber Security
React security advisory (AV26-1152)