shouldiuse.io

Categories

VERDICT

Create-react-app Review

Skip

Should I use Create-react-app?

Skip to main content - create-react-app.dev

· 2 days ago

The React team officially sunset Create React App in February 2025, so no new project picks it today. Only developers maintaining legacy CRA apps still touch it, and they plan moves to Vite or Next.js.

Confidence

High. Based on 14 public sources, including the official React deprecation post.

Ratings

  • Value for money
  • Ease of use
  • Feature depth
  • Support quality
  • Security posture

Pricing

$0

Open source

ModelNot disclosed
Monthly feesNot disclosed
HardwareNot disclosed
Free tierYes

Best for

  • Maintainers of legacy CRA apps
  • Learners on old tutorials
  • Quick throwaway prototypes

Not for

  • Any new React project in 2026
  • Teams needing fast builds and server rendering
  • Security-sensitive production apps
  • Anyone following current React docs

Gotchas - check before you buy

high

Deprecated: expect no new features or fixes; plan your migration now

high

Fresh npx runs show 5 audit vulnerabilities (2 high, 3 medium)

medium

Migration swaps the whole build toolchain; expect real rework

medium

Courses and professors still teach CRA despite the deprecation

Pros and cons

Pros

  • Free and open source
  • Zero-config setup aimed at first-time React learners
  • Served as the React team's official starter for years
  • Official docs cover setup and deployment

Cons

  • Officially deprecated and sunset by the React team
  • Slow builds; one user cut build times 90% after switching
  • Fresh installs report 5 dependency vulnerabilities, 2 high
  • React docs and community now recommend Vite or

Sources & method

- 14 sources - Deprecated tool; fresh installs trigger npm audit warnings and one CVE database entry lists a CRA remote code execution issue.

official x3review x7security x2news x2
  • CVE-2026-14802: React Create-React-App RCE, SentinelOne's vulnerability database lists this CVE against Create React App as a remote code execution issue.
  • Fresh installs report 5 vulnerabilities (2 high, 3 medium), Developers report npm audit warnings right after running npx create-react-app.
  • Dependency security issues tracked in GitHub issue #9815, Users track security vulnerabilities detected in CRA dependencies on the official repo.

Key stats

  • Value for money: 5/5

    Rating

  • $0

    Starting price

  • 14

    Sources

  • Analyzed

  • Value for money: 5/5. Free and open source
  • Ease of use: 3/5. Easy start, but slow and messy builds
  • Feature depth: 2/5. Guess: no routing, SSR, or data layer built in
  • Support quality: 1/5. Deprecated, no maintenance planned
  • Security posture: 2/5. Audit warnings on fresh installs, CVE listed
  • Deprecated Official status By the React team, Feb 14, 2025
  • $0 Price Free, open source, donor funded
  • 5 vulnerabilities Fresh install audit 2 high, 3 medium (user report)
  • -90% Build time after switch One user report moving off CRA

Pricing

Open source

$0

  • Full project scaffolding
  • Community support only
  • Donor funded via OpenCollective

Security

Deprecated tool; fresh installs trigger npm audit warnings and one CVE database entry lists a CRA remote code execution issue.

  • CVE-2026-14802: React Create-React-App RCESentinelOne's vulnerability database lists this CVE against Create React App as a remote code execution issue.10
  • Fresh installs report 5 vulnerabilities (2 high, 3 medium)Developers report npm audit warnings right after running npx create-react-app.⁹
  • Dependency security issues tracked in GitHub issue #9815Users track security vulnerabilities detected in CRA dependencies on the official repo.11

What users say

Users and the React team agree Create React App served beginners well but is now dead in favor of Vite and Next.js.

“Getting 5 vulnerabilities (2 high 3 medium) when i run npx create-react-app”
Reddit, r/react
“create-react-app is too slow and creates messy apps”
StackOverflow
“Create React App is Dead. What does it mean for you?”
dev.to

Alternatives

Compare Create-react-app with each alternative.

  • Vite

    Fast dev server and builds; current community default for plain React.

  • Next.js

    Full React framework with routing, server rendering, and deployment built in.

  • TanStack Start

    Newer React framework option highlighted in 2025 coverage.

Full analysis

Based on 14 public sources, including the official React deprecation post.

Deprecated by the React team in Feb 2025. New React projects go to Vite or Next.js; only legacy CRA code touches it.

Methodology

Based on 14 public sources, including the official React deprecation post.

Read how a report is made.

Sources

  1. Sunsetting Create React Appreact.dev
    official
  2. Getting Startedcreate-react-app.dev
    official
  3. Create React Appopencollective.com
    official
  4. Create React App is Dead. What does it mean for you?dev.to
    news
  5. Stop Using Create React App in 2026 — Next.js and Vite Have Taken Overmedium.com
    news
  6. 4 Reasons Why You Should Prefer Vite Over Create-React-Appsemaphore.io
    review
  7. Vite 3.0 vs. Create React Appblog.logrocket.com
    review
  8. create-react-app is too slow and creates messy appsstackoverflow.com
    review
  9. Getting 5 vulnerabilities (2 high 3 medium) when i run npx create-react-appreddit.com
    review
  10. CVE-2026-14802: React Create-React-App RCEsentinelone.com
    security
  11. Security Vulnerabilities detected in the dependency treegithub.com
    security
  12. Should I "still use" create-react-app? #12644github.com
    review
  13. The 9 best Create React App alternativesblog.logrocket.com
    review
  14. I Stopped Using Create React App - My Build Times Dropped 90%navanathjadhav.medium.com
    review

Cite this review

This check for Create-react-app says Skip.

Put the badge on a page that cites the review.

The link points here, and search engines follow it.

This is the badge visitors see on your site.

Skip Create-react-app Independent review on Should I Use It

Paste one snippet. Keep the link as it is. A nofollow tag stops search engines from following it.

Rate this review

Anonymous. You can change your vote.

Loading votes…

Comments

One queue. No nested comments. Give a display name first. Limit: 200 words per comment and 7 comments per day. You can edit or delete yours.

Save a name to write a comment.

0 / 200 words

No comments yet.