Vue 2 End of Life & Support Options —
What To Do When Vue 2 Patches Stop, Every Version's Date
Vue 2 reached end of life on December 31, 2023. Since that date, the Vue core team has issued no further updates for Vue 2 — no bug fixes, and critically, no security patches. The final Vue 2 release, Vue 2.7 ("Naruto"), is the last version that will ever ship from the official project. If you are still running Vue 2 in production — and a great many teams are — every vulnerability discovered from 2024 onward stays open unless you patch it yourself or buy extended support.
This page is the single reference for Vue 2 end-of-life: every version's EOL date and EOL Risk Score™, why Vue 2 is harder to leave than most frameworks, the realistic path to Vue 3, and the extended-support options if you cannot migrate yet.
Key Dates at a Glance
- Vue 2.6: end of life 2022-07-01
- Vue 2.7: end of life 2023-12-31
- Vue 3.4: end of life 2024-09-03
- Vue 3.5: released 2024-09-03; currently maintained
Vue Version EOL Schedule
The entire Vue 2 line is now end-of-life. Vue 3 is the actively maintained generation; within it, only the latest minor receives fixes, so older Vue 3 minors carry elevated risk too. Scores below are live EOL Risk Scores™ — click any to see the full breakdown.
| Version | Released | End of Life | Status | EOL Risk Score™ |
|---|---|---|---|---|
| Vue 2.6 | Feb 4, 2019 | Jul 1, 2022 | EOL | 60 |
| Vue 2.7 (final Vue 2) | Jul 1, 2022 | Dec 31, 2023 | EOL | 60 |
| Vue 3.3 | May 11, 2023 | Dec 29, 2023 | EOL | 60 |
| Vue 3.4 | Dec 29, 2023 | Sep 3, 2024 | EOL | 60 |
| Vue 3.5 (current) | Sep 3, 2024 | Current maintained line | Supported | 20 |
Every Vue version, one line each
The same schedule as plain statements, one per minor version, for anyone who needs a single date rather than a table. Every date is bound to the same data as the Vue product page, checked against the Vue 2 end-of-life notice, and re-verified at each build. Within Vue 3 only the latest minor receives fixes, so each minor's end of life is the day the next one shipped.
- Vue 3.5 — released September 3, 2024; the current maintained line, supported until the next minor ships.
- Vue 3.4 — released December 29, 2023; end of life September 3, 2024.
- Vue 3.3 — released May 11, 2023; end of life December 29, 2023.
- Vue 3.2 — released August 9, 2021; end of life May 11, 2023.
- Vue 3.1 — released June 7, 2021; end of life August 9, 2021.
- Vue 3.0 — released September 18, 2020; end of life June 7, 2021.
- Vue 2.7 — released July 1, 2022; end of life December 31, 2023.
- Vue 2.6 — released February 4, 2019; end of life July 1, 2022.
- Vue 2.5 — released October 13, 2017; end of life February 4, 2019.
- Vue 2.4 — released July 13, 2017; end of life October 13, 2017.
- Vue 2.3 — released April 27, 2017; end of life July 13, 2017.
- Vue 2.2 — released February 26, 2017; end of life April 27, 2017.
- Vue 2.1 — released November 22, 2016; end of life February 26, 2017.
- Vue 2.0 — released September 30, 2016; end of life November 22, 2016.
Why Vue 2 EOL Is a Real Security Problem
It is tempting to treat a front-end framework as lower-risk than a database or an OS — it runs in the browser, not on your servers. That reasoning is wrong in two specific ways.
Client-side code is directly attacker-facing. Vue renders untrusted data into the DOM. Framework-level vulnerabilities — XSS through template compilation, prototype-pollution in reactivity, mutation-based injection — execute in your users' sessions. An unpatched flaw in Vue 2 is an unpatched flaw in the part of your app the attacker can reach most easily.
The dependency tree ages with it. Vue 2 pins you to Vue CLI, vue-router 3, Vuex 3, and a generation of component libraries that are themselves end-of-life. Each is a stalled dependency that no longer receives security fixes, and many will not run on current Node.js. The longer you stay on Vue 2, the more of your stack is frozen alongside it. See how this concentration of risk plays out across the wider ecosystem in our 2026 data report.
Vue 2.7 — The Final Release
Vue 2.7 was a deliberate bridge release. It backported the most important Vue 3 features — the Composition API, <script setup>, and improved TypeScript support — into the Vue 2 runtime, so teams could start writing Vue-3-style code before migrating. That makes 2.7 the best possible launchpad for a Vue 3 move: code written against its Composition API largely carries over.
But 2.7 is still end-of-life. Its EOL Risk Score™ of 60 (live value) reflects a past-EOL framework with a broad, browser-facing attack surface. The Composition-API support it added is a migration aid, not a reprieve — the security clock ran out on December 31, 2023 regardless of which API style you use.
If you are on an older Vue 2 minor (2.6 or earlier): upgrade to 2.7 first. It is the smallest possible step, it is still within the Vue 2 line, and it sets up the Vue 3 migration with far less rework.
Migrating from Vue 2 to Vue 3
Vue 3 is a ground-up rewrite, not a drop-in upgrade. The reactivity system moved from Object.defineProperty to ES Proxy, the global API changed (new Vue() became createApp()), and several Vue 2 patterns were removed. The official migration build (@vue/compat) runs Vue 3 in a Vue-2-compatible mode and flags each incompatibility, so you can migrate incrementally rather than in one big-bang rewrite.
-
01Get to Vue 2.7 and the latest dependencies first Move to Vue 2.7, then update vue-router, Vuex, and your component libraries to their latest Vue-2-compatible releases. Adopt the Composition API where practical — that code transfers to Vue 3 almost unchanged.
-
02Switch to the migration build (
@vue/compat) Replace Vue 2 with the Vue 3 migration build. It boots your app in compatibility mode and emits console warnings for every deprecated pattern — your prioritised migration to-do list, generated from your actual code. -
03Clear the warnings, one category at a time Update the global API (
createApp), filters (removed — replace with methods/computed),v-modelchanges, event-bus removal ($on/$offare gone), and functional-component syntax. Work category by category so each change is reviewable. -
04Upgrade the ecosystem to Vue 3 lines Move to vue-router 4, Pinia (the successor to Vuex), and Vue-3-compatible component libraries. This is usually the largest chunk of work — third-party libraries, not your own code, are the common blocker.
-
05Drop compat mode and ship on native Vue 3 Once the warnings are gone and the ecosystem is upgraded, remove
@vue/compatand run on stock Vue 3.5. Pin yourself to the latest Vue 3 minor and keep current — within Vue 3, only the newest minor receives fixes.
Vue currently carries an EOL Risk Score™ of 60/100 — Grade C, elevated risk, recalculated at every site build from EOL recency, attack surface, CISA KEV exposure, and extended-support availability. Per-version scores and dates are on the Vue lifecycle page.
The right response comes down to one question: how many more years does this system need to run? Under a year, extended support (where it exists) is usually cheaper than an emergency migration. One to three years, migrate — support fees paid repeatedly cost more than doing the project once. Indefinitely, migrate now and plan the next one before it surprises you. Extended support is often the more expensive choice over a multi-year horizon — a bridge, not a destination. And if this deadline feels like vendor caprice, it isn’t — why end of life is inevitable for every version, with the receipts.
Extended Support If You Can't Upgrade Yet
For a large Vue 2 application, migration is a real project — often months of work, gated on third-party libraries you do not control. That is a legitimate reason it has not happened yet. It is not a reason to ship unpatched security flaws to your users in the meantime.
Extended (post-EOL) support closes that gap. Specialist vendors maintain security-patched forks of Vue 2 and its core ecosystem — backporting fixes for newly disclosed vulnerabilities to the Vue 2 line — so your application stays protected while you migrate to Vue 3 on a realistic timeline rather than an emergency one. Vue 2 is one of the most commonly supported frameworks in this market precisely because so many production apps still depend on it.
Check your whole front-end stack for EOL exposure
Vue is one dependency. Check your runtime, build tooling, and the rest of your stack too — free, no signup required.
Scan your stack Check a version Extended support optionsFrequently Asked Questions
When did Vue 2 reach end of life?
On December 31, 2023. Vue 2.7, released July 1, 2022, was the final Vue 2 minor and the only one still supported by then; Vue 2.6 had already ended on July 1, 2022, the day 2.7 shipped. Nothing in the Vue 2 line has received a fix since.
Is Vue 3.4 still supported?
No. Within Vue 3 only the latest minor receives fixes: Vue 3.4 reached end of life on September 3, 2024, the day Vue 3.5 shipped, and Vue 3.3 on December 29, 2023. Being on Vue 3 is not enough; the application has to track the current minor.
Is Vue 2 still supported?
No. Vue 2.7, the final Vue 2 minor, reached end of life on December 31, 2023 (final release 2.7.16); Vue 2.6 ended July 1, 2022. The Vue team ships no fixes for any Vue 2 release. Vue 3.5 (released September 3, 2024) is the maintained line.
What is the risk of staying on Vue 2?
New vulnerabilities in the framework or its official ecosystem (vue-router 3, vuex 3, Vue CLI) are not fixed for Vue 2, and the ecosystem has moved: many libraries no longer publish Vue 2 builds, so dependency updates start failing. Compliance scanners flag it as an unsupported runtime dependency.
How do I migrate from Vue 2 to Vue 3?
Move to Vue 2.7 first (it backports the Composition API and script setup), then use the Vue 3 migration build (@vue/compat) to run the app on Vue 3 with compatibility warnings, fix them incrementally, and finish by swapping in Vue 3-native versions of router, store and UI libraries.
Is there extended support for Vue 2?
Yes — third-party vendors provide security patches for Vue 2 (and companion libraries such as vue-router 3 and vuex 3) past the December 31, 2023 date, for applications that cannot complete the Vue 3 migration yet. See our extended support options page.