React End-of-Life Dates —
What's Actually Supported in 2026
React has no end-of-life dates. It has never had one. There is no LTS program, no support matrix, and no announcement that "React 18 reaches EOL on date." Anyone who quotes you a hard React 18 EOL date is inventing it. That is precisely why teams get caught: you cannot plan a migration against a deadline nobody publishes.
What React does commit to, in its official versioning policy, is narrower than most people assume and broader than the "only the latest version is supported" folklore: if a security vulnerability is found, React ships a backported fix for every major version affected by it. Patch releases are otherwise reserved for "the most critical bugs and security vulnerabilities." Bug fixes, performance work, and new features land only on the current major.
So the honest status of React 18 is not "end of life" — it is frozen, with one conditional promise attached. And the release history shows exactly what frozen looks like in practice:
Read that carefully, because both halves matter. If a serious CVE lands in React tomorrow and it affects 18, React's stated policy says a fix gets backported. But everything short of that bar — the ordinary bugs, the ecosystem-compatibility fixes, the performance work — stopped arriving for React 18 more than two years ago.
React EOL Schedule — All Major Versions
React follows semantic versioning, and active development happens only on the current major. Because React publishes no EOL dates, the community convention — the one used by endoflife.date and mirrored here — treats a major version as leaving support on the day its successor ships. That is a convention, not a vendor statement, and we label it as such. The "last release" column below is the harder evidence: it is the date React actually last shipped code for that line.
| Version | Released | Succeeded by | Last release | Status | EOL Risk Score™ |
|---|---|---|---|---|---|
| React 15 | Apr 2016 | React 16 (Sep 2017) | 15.7.0 · Oct 14, 2020 | EOL | 70 |
| React 16 | Sep 2017 | React 17 (Oct 2020) | 16.14.0 · Oct 14, 2020 | EOL | 70 |
| React 17 | Oct 2020 | React 18 (Mar 2022) | 17.0.2 · Mar 22, 2021 | EOL | 70 |
| React 18 | Mar 2022 | React 19 (Dec 2024) | 18.3.1 · Apr 26, 2024 | Frozen · security backports only | 62 |
| React 19 | Dec 2024 | Current | 19.2.8 · Jul 21, 2026 | Supported | 40 |
React 18 — Frozen Since April 2024
React 18 was the current version for nearly three years — March 2022 to December 2024. It introduced concurrent rendering, automatic batching, Suspense improvements, and the useTransition and useDeferredValue hooks. It is still the most widely deployed React version in the ecosystem, which is exactly why its status matters.
The precise status: React 18 is not "end of life," because React never declared one. It is frozen. Its last release, 18.3.1, shipped on April 26, 2024 — seven months before React 19 arrived — and nothing has shipped on the 18 line since. Under React's versioning policy a security fix would still be backported to 18 if a vulnerability affected it; no such release has been needed, or made, in the intervening two years.
Why the Risk Score is 42 (Medium), and what it is measuring. Our EOL Risk Score awards up to 40 of its 100 points for how long a version has been out of support. Most products supply a published end-of-life date for that calculation; React supplies none, so we measure from the date active support ended instead — December 5, 2024 for React 18, the day React 19 shipped. That inferred date is weaker evidence than a vendor's declared EOL, so it runs on a lower curve capped at 30 points rather than 40: an assumption should never score as confidently as a commitment. React 18 earns 22 of those points, plus 20 for attack surface and 20 for CISA KEV, for 62/100 overall — against React 19's 40/100 and React 16's 70/100.
A correction worth stating plainly: until August 13, 2026 this page reported 20/100 for every React version, including React 15. Our recency factor required a published EOL date, and since React has never issued one, that factor silently scored zero across the board — so a 2020-vintage React looked identical to the current release. The support-end fallback above fixes it. What the score still will not do is invent a lifecycle commitment React has never made: it ranks React versions by time out of support, attack surface, CISA KEV presence, and extended-support availability, and nothing more. The release history above remains the primary evidence.
What actually bites you on React 18 is the ecosystem, not a CVE. Library authors drop React 18 peer-dependency support; React 19-only features (the use hook, Actions, improved Server Components) are unavailable; and the longer you wait, the larger the eventual upgrade. This is a plan-your-quarter problem, not a drop-everything one.
What to do: Schedule the upgrade to React 19 deliberately. For most React 18 codebases it is a genuinely modest migration — see the section below.
React 17 — Effectively Unsupported
React 17 was notable for being the first major React release with no new developer-facing features — it was purely an infrastructure release that changed event delegation from document to the React root. This made it easier to embed React trees inside apps built with other technologies, and easier to upgrade React itself incrementally.
React 17 is now two major versions behind, and its last release was 17.0.2 in March 2021 — over five years of silence. React's security-backport promise nominally still covers it, but nothing has been shipped to the line in half a decade, and no library in the modern ecosystem targets it.
What to do: Upgrade to React 19. If your codebase is on 17, a direct jump to 19 is feasible but requires reviewing breaking changes across two major versions. The React 19 upgrade guide covers the full list.
React 16 — Long Past EOL
React 16 was a landmark release — it introduced the Fiber reconciler (a complete rewrite of React's core), error boundaries, portals, fragments, and the context API. It powered the ecosystem for three years. It is now three major versions behind.
React 16's last release was 16.14.0 on October 14, 2020 — and it is worth knowing what that release actually was, because it cuts against the usual assumption. It was not a security patch: React backported the new JSX transform to both 16.x and 15.x on the same day, four years after React 15 had been superseded. React does reach back to old lines when it decides the change matters. It simply has not decided that about anything since.
React 16 also depends on older build tooling that may itself be EOL — Create React App (archived), older Webpack configurations, and Babel configurations that haven't been touched in years.
What to do: This is a full modernization project, not just a version bump. Plan for dependency audits, build tool updates, and code changes. Prioritize this if your application handles user data.
React 19 — Current Supported Version
React 19 is the current actively supported version. Key additions include Actions (async functions for state transitions), the use hook for reading resources including Promises, improved Server Components support, and new document metadata APIs that eliminate the need for libraries like React Helmet.
React 19 maintains several minor lines at once, which is unusual enough to be worth planning around. On July 21, 2026, React shipped 19.0.8, 19.1.9 and 19.2.8 on the same day — three separate minor lines patched together. Staying on 19.0 or 19.1 rather than 19.2 has so far still meant receiving fixes. That is a courtesy React extends, not a documented guarantee, so treat the newest minor as the safe default.
React 19 also removed several long-deprecated APIs — propTypes, defaultProps on function components, legacy string refs, and legacy Context API patterns. These removals are the primary source of breaking changes when upgrading from 16 or 17.
This is your target version. If you're on 18, the upgrade is straightforward. If you're on 16 or 17, plan for a fuller migration.
Why React EOL Is Harder to Track Than Node or Python
Most developers think of React as a dependency, not as infrastructure with a lifecycle — and that's exactly why React EOL risk gets missed.
No hard dates. Node.js tells you "Node 18 EOL: April 30, 2025." Python tells you "Python 3.8 EOL: October 7, 2024." Meta publishes no equivalent for React. The practical EOL date is inferred from when the next major version ships — which you only know after the fact.
React is client-side. Vulnerability scanners and SCA tools typically scan your server-side dependencies more thoroughly than your frontend bundle. React 16 running in a browser bundle often goes undetected by security tooling that's scanning your package.json server dependencies.
React 18 is everywhere. The npm download numbers for React 18 are enormous. It's the version that most of the ecosystem built against — component libraries, testing utilities, meta-frameworks. Many teams are still on 18 not because they haven't noticed, but because their dependency tree hasn't forced the move yet.
How to Upgrade to React 19
From React 18 — Straightforward
-
01Update dependencies Run
npm install react@19 react-dom@19. Also update@types/reactand@types/react-domif you're using TypeScript. React 19 ships its own types — the DefinitelyTyped packages are now secondary. -
02Run the React 19 codemod Meta provides an official codemod:
npx codemod@latest react/19/migration-recipe. This handles the most common breaking changes automatically — updating ref handling, removing deprecated APIs, and updating context usage patterns. -
03Check third-party libraries The most common blocker for React 19 upgrades is third-party component libraries that haven't updated their peer dependency declarations. Run
npm install --legacy-peer-depsas a temporary measure while you wait for libraries to update — but flag these as technical debt to resolve. -
04Review removed APIs React 19 removed
propTypes, string refs, legacy context (contextTypes/childContextTypes), andReactDOM.render(deprecated in 18, removed in 19). The codemod handles most of these — manually review any it flags but doesn't auto-fix.
From React 16 or 17 — Plan a Full Migration
-
01Audit your full dependency tree first Run
npm outdatedandnpx depcheck. Identify every dependency that has a peer dependency on React 16 or 17 — these need to be updated or replaced before or alongside the React upgrade. -
02Upgrade your build tooling If you're on Create React App (archived), migrate to Vite or Next.js before upgrading React. CRA is unmaintained and won't support React 19. This is often the larger project inside the React upgrade.
-
03Upgrade to 18 first, then 19 Jumping two major versions directly is possible but creates a larger blast radius for debugging. Upgrading to 18 first, stabilizing, then upgrading to 19 is lower risk and easier to scope as two separate sprints.
-
04Use StrictMode to surface issues early
<React.StrictMode>activates additional checks that surface deprecated patterns before they become breaking changes. If you're on 16 or 17 and not using StrictMode, enable it in development now — it will expose issues you'll need to fix for 19 anyway.
Frequently Asked Questions
Is React 18 still supported?
Partially, and the distinction matters. React 18 receives no bug fixes, performance work, or features — its last release was 18.3.1 on April 26, 2024. It remains covered by React's written commitment to backport fixes for security vulnerabilities affecting any major version, but that promise has not needed to be exercised for React 18 in over two years. In practical terms React 18 is frozen rather than end-of-life.
What is the React 18 EOL date?
There isn't one. React has never published end-of-life dates for any version and operates no LTS program. Any specific "React 18 EOL date" you encounter has been inferred rather than announced. The most defensible proxy is December 5, 2024 — the day React 19 shipped and active development on 18 stopped — which is the convention the endoflife.date community dataset uses.
Does React 19 have an end-of-life date?
No. React 19 is the current major version and is actively developed; by React's convention it will move to frozen status whenever React 20 ships, with no date announced in advance. React currently maintains several React 19 minor lines simultaneously — 19.0.8, 19.1.9 and 19.2.8 were all released on July 21, 2026.
Is React 17 still safe to use?
React 17 has had no release since 17.0.2 in March 2021. There are no known exploited vulnerabilities against it, so the immediate security risk is low, but the practical costs are real: modern libraries no longer support it, build tooling around it is largely unmaintained, and each year the eventual upgrade grows. Treat it as technical debt with a compounding interest rate rather than an emergency.
What is React 18's EOL Risk Score, and how is it calculated without an EOL date?
React 18 scores 62 out of 100 (High). Because React publishes no end-of-life dates, the recency component is measured from the day active support ended — December 5, 2024, when React 19 shipped — rather than from a declared EOL date, and it runs on a lower curve capped at 30 of the available 40 points, because an inferred end date is weaker evidence than a vendor's stated one. React 18 earns 22 recency points plus 20 for attack surface. For comparison, React 19 scores 40 and React 16 scores 70. Note that until August 13, 2026 every React version scored an identical 20/100: the factor required a published EOL date that React never issues, so it scored zero for all of them. See the Risk Score methodology.
Do I get React security patches through Next.js or Remix instead?
Not exactly — your framework pins a React version, so its upgrade cadence determines which React you actually run. A framework release that bumps its React dependency effectively upgrades React for you, and a framework stuck on an older React keeps you there too. When auditing exposure, check the resolved React version in your lockfile rather than the version you believe you are on.
Check your full stack for EOL exposure
React is one component. Check your runtime, OS base images, and backend dependencies too — free, no signup required.
Scan your stack Check a version Risk Score methodology