Treat it as a risk to plan out, not an emergency. The React team deprecated Create React App on 14 February 2025 for new apps, and said it had no active maintainers. It still works in maintenance mode, but you should expect no meaningful fixes, so plan a migration.
What the React team said
The announcement, "Sunsetting Create React App", says the team deprecated Create React App for new apps and encouraged existing apps to migrate to a framework, or to a build tool such as Vite, Parcel or RSBuild. It also says that since the tool had no active maintainers, and many existing frameworks solve its limitations, deprecation was the choice. It continues to work in maintenance mode, and a new version was published to work with React 19. New installs show a deprecation warning.
Why that matters for security
Create React App bundles a large set of build tools and dev dependencies into one pinned configuration. When a tool has no active maintainers, three things follow.
- New advisories in its dependency tree may not get a release that updates them.
- You can override transitive versions yourself, but each override is something you now own and must test.
- Scanners keep flagging the same findings, and teams learn to ignore them, which hides real ones.
None of this means your running app is compromised. Many findings in build tooling affect the developer machine or build server, not the browser bundle. That distinction is the heart of triage.
How to assess your own exposure
- List the dependencies: run a full tree listing and note the build tool packages versus runtime packages.
- Scan the lockfile, then separate findings in packages that ship to browsers from those that only run during build.
- Check whether the vulnerable code is reachable at all. A dev server flaw matters less if nobody exposes the dev server to a network.
- Note which findings you can fix with overrides, and which need the toolchain replaced.
- Record the decision and a date to revisit, so it is a managed risk and not forgotten debt.
Options for moving off
| Option | Best when | Trade-off |
|---|---|---|
| A React framework | You want routing, data loading and a maintained toolchain | Larger change, new concepts |
| A build tool such as Vite | You want to keep a client-only single page app | You wire up more yourself |
| Stay and override | You need time, the app is internal | Ongoing ownership of the fixes |
The React team's post also links to docs for building without a framework when one does not fit.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how direct and transitive packages are listed, which is the first view you need to judge a build toolchain.
Safeguard's dependency scanning and reachability analysis can help separate build-only findings from ones that matter, and the free scan at gold.safeguard.sh/scan is a quick start.
Quick check
Will my existing Create React App app stop working?
No. The team says it continues working in maintenance mode. The risk is the lack of ongoing maintenance, not a sudden break.
Is every scanner finding in it exploitable?
No. Many sit in build tooling. Check whether the package ships to browsers and whether the vulnerable path is reachable.
Sources
Last reviewed: 19 October 2026.
