react-dom

About

React package for working with the DOM.

What detecting react-dom tells you about a site

react-dom is the renderer that pins React to the browser, so its presence confirms a genuine web React app rather than React Native, Ink or another custom renderer. Seeing react-dom/client (the React 18+ entry point) versus the old react-dom render path is a quick read on how recently the rendering bootstrap was written.

Why the exact react-dom version matters

react-dom's version tracks react's lock-step, and a mismatch between the two is a real-world bug source. Reading the exact bundled react-dom version tells you whether the site is on the createRoot/hydrateRoot API (18+) or the legacy ReactDOM.render path, which affects hydration behaviour, Suspense support and streaming SSR.

react-dom in a real-world stack

When you find react-dom in a bundle, it rarely travels alone. react (always — the two version numbers should match), and a framework like Next.js or Remix that owns the hydration entry point.

Quick facts

Common pairings

Packages this one expects to find in the same project. Each is also a Sourcemap Explorer detection target.

What react-dom pulls in

react-dom declares 1 direct dependency — each one also rides into any bundle that ships react-dom, so they are detection targets too. Reading them is a quick way to understand the package's real footprint .

How Sourcemap Explorer detects react-dom

react-dom ships as v19.2.8, published 2026-07-21 and carries 1 direct dependency, 1 peer dependency (react), 2,853 versions on the registry. Those exact numbers are the footprint Sourcemap Explorer matches when react-dom rides inside a deployed bundle — here is how the detection works.

We catch react-dom from two complementary signals: bundled source paths and the embedded package.json. Modern bundlers (webpack, Vite, esbuild, Rollup, Turbopack) preserve the original node_modules/react-dom/ paths inside the JavaScript sourcemap's sources[] array — that's the canonical signal. When the matching package.json is also captured in sourcesContent[], we read the exact version field — patch number included. No regex guessing, no version inference.

1. 1

   Confirm the site exposes sourcemaps

   In DevTools Network, check the response headers of any application script for `SourceMap` or `X-SourceMap`. Failing that, fetch the script's last 4 KB and look for a `//# sourceMappingURL=` comment — that map is where the `react-dom` paths live.

2. 2

   Find the package in the bundle

   Open DevTools → Network → reload. Click any application script and look at its sourcemap. Inside, search `sources[]` for entries matching `node_modules/react-dom/` — every match confirms the package is bundled. The matching `sourcesContent[i]` for `node_modules/react-dom/package.json` gives you the exact installed version.

3. 3

   Read the version directly from package.json

   Run `jq -r '. as $m | $m.sources | to_entries[] | select(.value | endswith("node_modules/react-dom/package.json")) | $m.sourcesContent[.key] | fromjson | .version' bundle.js.map`. Sourcemap Explorer automates the same query in the popup.

Major releases of react-dom

When each major version first landed. Major bumps are where breaking changes live, so this timeline is the fastest way to date the react-dom version a site actually ships against the ecosystem.

Recent security advisories for react-dom

The 1 most recent advisories affecting some versions of react-dom, aggregated from OSV.dev (GitHub Advisory + CVE data). A listing here doesn't mean the version a given site ships is affected — each advisory applies to a specific version range. Sourcemap Explorer reads the exact bundled version so you can check it against these ranges.

1. MODERATECVE-2018-6341· 2019-01-04

   Cross-Site Scripting in react-dom

Recent versions

react-dom README

Live mirror of the GitHub README, for reference. Updated whenever the repo's default branch changes.

import { createRoot } from 'react-dom/client';

function HelloMessage({ name }) {
  return <div>Hello {name}</div>;
}

const root = createRoot(document.getElementById('container'));
root.render(<HelloMessage name="Taylor" />);

FAQ

Keep reading on Sourcemap Explorer