Skip to main content
cve.nowby Sazabi
← npm
npmPackage

react-dev-utils

3 known vulnerabilities (1 critical, 1 medium), with the versions each affects and the releases that fix them.

Latest release
12.0.1 (Apr 12, 2022): no advisory affects it
Newest unaffected release
12.0.1 (Apr 12, 2022), the latest release
Advisories
3 · 1 critical, 1 medium
Weekly downloads
5.5M
Dependents
40.4K
Releases
116 since 0.0.0 (Sep 23, 2016)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-14802
    Affects 0.0.0 to 5.0.1 (5.0.2 is outside it)
  • CVE-2021-24033
    Affects 0.4.0 to 11.0.3 (11.0.4 is outside it)
  • CVE-2018-6342
    Affects 1.0.0 to 1.0.3 (1.0.4 is outside it); 2.0.0 to 2.0.1 (2.0.2 is outside it); 3.0.0 to 3.1.1 (3.1.2 is outside it); 4.0.0 to 4.2.1 (4.2.2 is outside it); 5.0.0 to 5.0.1 (5.0.2 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 3

  • CVE-2026-14802Medium 6.9

    react create-react-app react-dev-utils openBrowser.js startBrowserProcess os command injection

    Affected: through 5.0.1.

    Fixed in 5.0.2 (released Aug 22, 2018, 2875 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 12.0.1, is not affected.

    1.8% of react-dev-utils downloads last week were affected versions (114.4K).

  • react-dev-utils prior to v11.0.4 exposes a function, getProcessForPort, where an input argument is concatenated into a command string to…

    Affected: from 0.4.0, fixed in 11.0.4.

    Fixed in 11.0.4 (released Mar 8, 2021, 1 day before disclosure).

    The latest release, 12.0.1, is not affected.

    13% of react-dev-utils downloads last week were affected versions (803.9K).

  • CVE-2018-6342Critical 9.8

    react-dev-utils on Windows allows developers to run a local webserver for accepting various commands, including a command to launch an…

    Affected: from 1.0.0, fixed in 1.0.4; from 2.0.0, fixed in 2.0.2; from 3.0.0, fixed in 3.1.2; from 4.0.0, fixed in 4.2.2; from 5.0.0, fixed in 5.0.2.

    Fixed in 1.0.4 (released Aug 24, 2018, 129 days before disclosure), 2.0.2 (released Aug 24, 2018, 129 days before disclosure), 3.1.2 (released Aug 24, 2018, 129 days before disclosure) and 2 other versions.

    The latest release, 12.0.1, is not affected.

    0.6% of react-dev-utils downloads last week were affected versions (37.7K).