React 19.3, the Compiler, and a CVSS 10: What Changed While You Weren't Looking
This week I pulled Create React App out of one project and wrote the plan to pull it out of another. Both were from 2022 and 2023, and both still worked. That is the deceptive part: still working and still being the right way to do it are different things, and between the two, four large changes happened in React that do not announce themselves. None of this is rumour. All four are on the…
This week, React 19.3, the Compiler, and a CVSS 10 were released without much fanfare. The compiler, already at version 1.0 on October 7, 2025, automatically memoizes components and hooks, eliminating the need for useMemo and useCallback. If a component violates React's Rules of React, the compiler skips optimization rather than producing incorrect results.
On December 3, 2025, React disclosed a critical vulnerability in Server Components, CVE-2025-55182, CVSS 10.0, allowing unauthenticated attackers to execute remote code on servers. The affected versions and frameworks include react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack, next, react-router, waku, @parcel/rsc, @vitejs/plugin-rsc, and rwsdk.
A second batch of vulnerabilities was announced on December 11, 2025, including denial of service (CVE-2025-55184, CVSS 7.5), source code exposure (CVE-2025-55183, CVSS 5.3), and additional server function issues (CVE-2025-67779, CVSS 5.3). These vulnerabilities require urgent attention, as they can lead to server crashes, out-of-memory errors, and exposure of sensitive information.
React 19.3, released on September 9, 2026, introduced new features like the ViewTransition API for animations during tree changes, Fragment refs for DOM manipulation without wrappers, and the use(browser()) hook to conditionally render components based on the environment. These updates streamline development and improve performance, but the vulnerabilities highlight the need for immediate action when serving Server Components.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
