Market title

Will a new Critical vulnerability affecting the React library be listed on NIST NVD by 2026 03 31?

Outcomes

Yes

No

Market close time

2026 03 31 at 23:59 UTC

Trading ends at close time. Resolution happens once the result is clear per the rules.

Resolution source

NIST National Vulnerability Database, CVE search and individual CVE detail pages.

Resolution criteria

This market resolves Yes if NIST NVD publishes at least one new CVE that meets all conditions below on or before the close time:

- 1. Product scope

The CVE must list React as an affected product. This includes React core or official React packages, including but not limited to react, react-dom, react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack.

- 2. Newness

The CVE must have an NVD “Published” date strictly after 2025 12 09 00:00 UTC. CVEs published earlier do not count.

- 3. Critical classification

On the NVD page, the CVSS v3.x or CVSS v4.0 base severity must be Critical, defined as: base score 9.0 to 10.0 inclusive, or severity label explicitly shown as Critical.

If at least one CVE satisfies all three conditions before the close time, resolve Yes.

This market resolves No if no CVE satisfying all conditions is published by the close time.

How to check

Search NVD for CVEs affecting React and sort by Published date. For any candidate CVE, open its NVD detail page and verify:

- Published date after 2025 12 09 00:00 UTC

- React listed in affected products

- CVSS base severity Critical (v3.x or v4.0)

Edge cases

- 1. Multiple scores

If both v3.x and v4.0 are shown, and either is Critical, the CVE counts.

- 2. Severity changes before close

If a qualifying CVE is published as Critical but later downgraded before close, it only counts if it was still Critical at any time before close.

- 3. Rejected or withdrawn CVEs

A CVE marked Rejected or Withdrawn does not count unless it met all conditions prior to rejection.

- 4. NVD outage

If NVD is unavailable at close, use the latest archived NVD snapshot from before close once access returns.

- 5. Post close publication

Anything first published after 2026 03 31 23:59 UTC does not count.