React-dom versions 16.4.0 and 16.3.3 are both React packages essential for manipulating the Document Object Model (DOM) within web applications. They share common characteristics including identical descriptions, dependency requirements on packages like fbjs, prop-types, loose-envify, and object-assign, and peer dependency on React version 16.0.0 or higher. Both versions are released under the MIT license and originate from the same GitHub repository.
The key differences reside in their version numbers, release dates, and the size of the unpacked distribution. Version 16.4.0 was released earlier, on May 24, 2018, while version 16.3.3 came out later, on August 1, 2018. Intriguingly, despite being an earlier release, version 16.4.0 boasts a larger unpacked size (2042338 bytes) compared to version 16.3.3 (2020935 bytes). This subtle difference suggests that version 16.4.0 likely includes more features, bug fixes, or performance improvements compared to its predecessor. Developers should carefully consider the release notes and changelogs associated with version 16.4.0 to fully understand the changes and weigh them against the stability and potentially fewer bugs present in the slightly older, smaller, version 16.3.3. However, the larger size of 16.4.0 may reflect optimizations crucial for specific use cases, rendering it a compelling choice despite the later release of its predecessor.
All the vulnerabilities related to the version 16.4.0 of the package
Cross-Site Scripting in react-dom
Affected versions of react-dom
are vulnerable to Cross-Site Scripting (XSS). The package fails to validate attribute names in HTML tags which may lead to Cross-Site Scripting in specific scenarios. This may allow attackers to execute arbitrary JavaScript in the victim's browser. To be affected by this vulnerability, the application needs to:
ReactDOMServer
If you are using react-dom
16.0.x, upgrade to 16.0.1 or later.
If you are using react-dom
16.1.x, upgrade to 16.1.2 or later.
If you are using react-dom
16.2.x, upgrade to 16.2.1 or later.
If you are using react-dom
16.3.x, upgrade to 16.3.3 or later.
If you are using react-dom
16.4.x, upgrade to 16.4.2 or later.
node-fetch forwards secure headers to untrusted sites
node-fetch forwards secure headers such as authorization
, www-authenticate
, cookie
, & cookie2
when redirecting to a untrusted site.