React End of Life - Dates and Lifecycle

Maintained by Meta and used across a huge share of production web frontends, React has been the default reference point for component-based UI development for over a decade. It's also the foundation many other frameworks are built on, including Next.js, which handles routing and server rendering on top of React itself.

React Lifecycle Explained

React's own team has been explicit that Security Support here works differently than on most software: there's no fixed cutoff date. React's official versioning policy states plainly, "we know our users continue to use old versions of React in production. If we learn of a security vulnerability in React, we release a backported fix for all major versions that are affected by the vulnerability." That commitment isn't limited to the two most recent majors, it applies to any affected version, no matter how old.

This matters because early aggregated EOL data for React, including on other reference sites, previously implied older majors like React 15 or 16 had a hard security cutoff. A React core team member publicly clarified that this didn't reflect actual policy, and the data has since been corrected to show no fixed Security Support end date for any React version. The exact scope of backporting also has a minor nuance: for the current major version, a critical fix is backported to every minor release, while for older, superseded majors, the fix goes to the latest minor of that major only, not every historical minor within it. What does have a real end date is Active Support, the period during which a major version receives new features, which closes once the next major version ships.