Never-Ending Support for Rails versions  2.3, 3.2, 4.2, 5.2, and 6.1

Rails NES

Never-Ending Support (NES) for Ruby on Rails from HeroDevs means you can stay secure, compatible, and compliant without migrating away.

White arrow
Get Pricing
View Docs
Ruby on Rails logo

Rails NES

is a secure drop-in replacement for

Rails

and takes just a few minutes to set up.

Step 1
Update your project’s Gemfile
Step 2
Set your token in your project’s local .gemrc file
Step 3
Install & run!
CVE Protection

19 Security Issues Fixed in Rails NES
(and always watching for more)

By purchasing Rails Never-Ending Support from HeroDevs, you’re ensuring that your Rails application stays secure and these vulnerabilities are mitigated. As more CVEs are discovered, you can rest easy knowing HeroDevs has remediated those issues before they’re ever announced publicly.

If you’re currently using Rails in your application’s tech stack, your application is vulnerable to the CVEs listed below.

Switch to Rails NES in minutes to mitigate these vulnerabilities immediately.
Severity
ID
Technology
Libraries Affected
Category
Version(s) Affected
Published Date
Medium
CVE-2025-25184
Open in new tab icon
Rails
Rack
Improper Output Neutralization for Logs
<2.2.11, <3.0.12, <3.1.10
Feb 14, 2025
High
CVE-2024-26142
Open in new tab icon
Rails
Ruby on Rails Framework
Denial of Service
7.1.0.0 to 7.1.3.0
Feb 27, 2024
High
CVE-2023-22794
Open in new tab icon
Rails
Ruby on Rails Framework
Remote Code Execution
<=6.0.6.0 <=6.1.7.0 <=7.0.4.0
Feb 9, 2023
Critical
CVE-2022-30123
Open in new tab icon
Rails
Ruby on Rails Framework
Remote Code Execution
2.2.0.0 - <=2.2.3.0 2.1.0.0 - <=2.1.4.0 2.0.0.0 - <=2.0.9.0
Dec 5, 2022
Critical
CVE-2022-21831
Open in new tab icon
Rails
Ruby on Rails Framework
Remote Code Execution
7.0.0.0 - <= 7.0.2.2 6.1.0.0 - <= 6.1.4.6 6.0.0.0 - <= 6.0.4.6 5.2.0.0 - <= 5.2.6.2
May 26, 2022
Critical
CVE-2020-8165
Open in new tab icon
Rails
Ruby on Rails Framework
Remote Code Execution
6.0.0 - <= 6.0.3.0 5.0.0 - <= 5.2.4.2
Jun 19, 2020
High
CVE-2020-8163
Open in new tab icon
Rails
Ruby on Rails Framework
Remote Code Execution
<= 5.0.0 Not affected: Applications that do not allow users to control the names of locals. <= 4.2.11.1
Jul 2, 2020
High
CVE-2020-8162
Open in new tab icon
Rails
Ruby on Rails Framework
Authorization Bypass
<= 5.2.4.1 <= 6.0.3.0 Not affected: Applications that do not use the direct upload functionality of the ActiveStorage S3 adapter.
Jun 19, 2020
High
CVE-2020-8161
Open in new tab icon
Rails
Ruby on Rails Framework
Remote Code Execution
< 2.1.3 < 2.2.0 Applications that do not use Rack::Directory
Jul 20, 2020
Critical
CVE-2020-8159
Open in new tab icon
Rails
Ruby on Rails Framework
Remote Code Execution
Rails 3.x Rails 2.x Rails > 4.x if using actionpack_page-cache <= 1.2.0
May 12, 2020
For more details on CVEs found in end-of-life software, visit our vulnerability directory.
Vulnerability Directory
Arrow
Report A Vulnerability

What is Never-Ending Support?

Security icon
Security Fixes
A new version of Rails NES will be released each time we find, validate, and fix a security issue.
Compatibility icon
Drop-In Compatibility
A direct replacement for your framework—no migrations, no rewrites, just ongoing support.
SLA Compliance
HeroDevs provides SLAs that ensure compliance by providing incident response and remediation in accordance with industry-standard regulations, including SOC 2, FedRAMP, PCI, and HIPAA.
Learn more.
Team of Experts
Rails NES is built with advisement and consultation of core team members from Rails.
Easy to Install
Our simple drop-in replacement means all you have to do is update your Gemfile and rebuild your project. No code changes or find & replace required.
Intellectual Property Protection
Rails NES is not only secure; HeroDevs also offers enterprise-level protection for all products.
Learn more

Why HeroDevs?

Built By Ruby on Rails Experts

Rails experts ensure Rails NES is the same quality you have come to expect when using Ruby on Rails open source projects.
‍
We specifically design our Rails NES product to work seamlessly and ensure it is as dependable as the original Rails projects you built your applications on.

Give back to open source icon
We Give Back To Open Source

HeroDevs is deeply committed to the open-source community. We give support through sponsorships, backing core contributors, and funding events that drive the ecosystem forward. Our engagement extends beyond financial contributions, embodying a commitment to the ongoing growth and innovation of open-source software. This holistic support ensures the vitality of the open-source movement, fostering an environment of collaboration and advancement.

Related Products

If you're leveraging this technology, chances are you're also using complementary systems that face similar end-of-life (EOL) challenges.

Explore our related NES products that offer proactive, comprehensive support for your entire tech stack to ensure continuity, security, and innovation across all your essential technologies.
View All Products
Arrow

Related Blog Posts

Security
Mar 24, 2025
CVE-2025-29927: Authorization Bypass in Next.js Middleware, What You Need to Know
A Critical Security Flaw in Next.js Middleware Puts Legacy Apps at Risk—HeroDevs’ NES Has the Fix
Thought Leadership
Mar 21, 2025
PCI DSS 4.0 Requirement 8: How to Identify Users and Authenticate Access to System Components
Strengthen Authentication and Identity Controls to Meet PCI DSS 4.0 Requirement 8
Thought Leadership
Mar 18, 2025
The FedRAMP Compliance Challenge: Navigating EOL Software in Federal Systems
Managing End-of-Life Software in FedRAMP Environments: Compliance, Security, and Operational Resilience
More posts

Contact Us

Got questions about Never-Ending Support for your open-source library? We're here to help!

Discover how HeroDevs NES Products can keep your systems secure and compliant.

Learn how our solutions can deliver value to your organization.

Get detailed pricing information tailored to your needs.

Trusted by industry leaders such as
Microsoft LogoBank Santander Logo SAP LogoFinra LogoCapital One LogoGeneral Electric LogoUnqork LogoGoogle LogoValid 8 logoQueenslandRail logoGSA logoDepartment of Health logo
Talk to an Expert

By clicking “submit” I acknowledge receipt of our Privacy Policy.

Thank you! Your submission has been received!
Please enter a company email.

By clicking "Accept", you agree to the storing of cookies on your device to enhance site navigation, analyze site usage, and assist in our marketing efforts. View our Privacy Policy for more information.

PreferencesRejectAccept
Manage Consent Preferences by Category
Essentials
Always active

Necessary for the site to function. Always On.

Used for targeted advertising.

Remembers your preferences and provides enhanced features.

Measures usage and improves your experience.

Reject AllAccept All
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.