React DOM version 16.4.1 represents a minor update to the foundational React library for web development, building upon the preceding version 16.4.0. Both versions share the same core description, serving as the essential package for manipulating and interacting with the Document Object Model (DOM) within React applications. They maintain identical dependency structures, relying on fbjs, prop-types, loose-envify, and object-assign for supporting functionalities, and declare react version 16.0.0 or higher as a peer dependency, ensuring compatibility within established React projects.
The key distinctions between these versions lie primarily in their distribution metadata. React DOM 16.4.1 exhibits a slightly larger unpacked size of 2152519 bytes and includes 28 files within its tarball, compared to React DOM 16.4.0, which has an unpacked size of 2042338 bytes and 27 files. The increment in file count and size for version 16.4.1 indicates that some internal adjustments or file additions were implemented. This updated version was released on June 13, 2018, a few weeks after the release of version 16.4.0 on May 24, 2018. Because version 16.4.1 is a patch release, developers can expect the changes to include bug fixes and minor improvements without any breaking changes or additional new features. Upgrading to it from version 16.4.0 is highly recommended because patch releases improve the stability of a package.
All the vulnerabilities related to the version 16.4.1 of the package
Cross-Site Scripting in react-dom
Affected versions of react-dom are vulnerable to Cross-Site Scripting (XSS). The package fails to validate attribute names in HTML tags which may lead to Cross-Site Scripting in specific scenarios. This may allow attackers to execute arbitrary JavaScript in the victim's browser. To be affected by this vulnerability, the application needs to:
ReactDOMServerIf you are using react-dom 16.0.x, upgrade to 16.0.1 or later.
If you are using react-dom 16.1.x, upgrade to 16.1.2 or later.
If you are using react-dom 16.2.x, upgrade to 16.2.1 or later.
If you are using react-dom 16.3.x, upgrade to 16.3.3 or later.
If you are using react-dom 16.4.x, upgrade to 16.4.2 or later.
node-fetch forwards secure headers to untrusted sites
node-fetch forwards secure headers such as authorization, www-authenticate, cookie, & cookie2 when redirecting to a untrusted site.