Secure drop-in replacements for Rails versions 2.3, 3.2, 4.2, 5.2, and 6.1

NEVER-ENDING SUPPORT FOR
Rails

Legacy Rails versions still function after support ends — but that's not good enough for internal SLAs, CVE disclosures, and security audits.

Never-Ending Support (NES) for Rails keeps you compliant, secure, and audit-ready without an unplanned migration or risky patchwork.

Ruby on Rails logo
Patch CVEs, Meet Internal SLAs, Pass Audits — in Minutes.
Ruby on Rails logo
NES for Rails
Secure drop-in replacements for Rails versions 2.3, 3.2, 4.2, 5.2, and 6.1
Ruby on Rails logo

Rails

NEVER-ENDING SUPPORT FOR

Never-Ending Support (NES) for Rails keeps you compliant, secure, and audit-ready without an unplanned migration or risky patchwork.

Ask a Question

By clicking "submit" I acknowledge receipt of our Privacy Policy.

Thank you! Your submission has been received!
Please enter a company email.
Patch CVEs, Meet Internal SLAs, Pass Audits — in Minutes.
Ruby on Rails logo
NES for Rails

NES for Rails

is a secure drop-in replacement for

Rails

and takes just a few minutes to set up.

Step 1
Update your project’s Gemfile
Step 2
Set your token in your project’s local .gemrc file
Step 3
Install & run!
CVE Protection

0 Security Issues Fixed in NES for Rails
(and always watching for more)

By purchasing Never-Ending Support for Rails from HeroDevs, you’re ensuring that your Rails application stays secure and these vulnerabilities are mitigated. As more CVEs are discovered, you can rest easy knowing HeroDevs has remediated those issues before they’re ever announced publicly.

If you’re currently using Rails in your application’s tech stack, your application is vulnerable to the CVEs listed below.

Switch to NES for Rails in minutes to mitigate these vulnerabilities immediately.
Severity
ID
Technology
Libraries Affected
Category
Version(s) Affected
Published Date
Medium
CVE-2025-49007
Open in new tab icon
Rails
Rack
Regular Expression Denial of Service
>=3.1.0 <3.1.16
Jun 26, 2025
Medium
CVE-2025-27111
Open in new tab icon
Rails
Rack
Log Injection
<2.2.12, <3.0.13, <3.1.11
Mar 4, 2025
Medium
CVE-2025-25184
Open in new tab icon
Rails
Rack
Improper Output Neutralization for Logs
<2.2.11, <3.0.12, <3.1.10
Feb 14, 2025
High
CVE-2024-26142
Open in new tab icon
Rails
Ruby on Rails Framework
Denial of Service
7.1.0.0 to 7.1.3.0
Feb 27, 2024
High
CVE-2023-22794
Open in new tab icon
Rails
Ruby on Rails Framework
Remote Code Execution
<=6.0.6.0 <=6.1.7.0 <=7.0.4.0
Feb 9, 2023
Critical
CVE-2022-30123
Open in new tab icon
Rails
Ruby on Rails Framework
Remote Code Execution
2.2.0.0 - <=2.2.3.0 2.1.0.0 - <=2.1.4.0 2.0.0.0 - <=2.0.9.0
Dec 5, 2022
Critical
CVE-2022-21831
Open in new tab icon
Rails
Ruby on Rails Framework
Remote Code Execution
7.0.0.0 - <= 7.0.2.2 6.1.0.0 - <= 6.1.4.6 6.0.0.0 - <= 6.0.4.6 5.2.0.0 - <= 5.2.6.2
May 26, 2022
Critical
CVE-2020-8165
Open in new tab icon
Rails
Ruby on Rails Framework
Remote Code Execution
6.0.0 - <= 6.0.3.0 5.0.0 - <= 5.2.4.2
Jun 19, 2020
High
CVE-2020-8163
Open in new tab icon
Rails
Ruby on Rails Framework
Remote Code Execution
<= 5.0.0 Not affected: Applications that do not allow users to control the names of locals. <= 4.2.11.1
Jul 2, 2020
High
CVE-2020-8162
Open in new tab icon
Rails
Ruby on Rails Framework
Authorization Bypass
<= 5.2.4.1 <= 6.0.3.0 Not affected: Applications that do not use the direct upload functionality of the ActiveStorage S3 adapter.
Jun 19, 2020
High
CVE-2020-8161
Open in new tab icon
Rails
Ruby on Rails Framework
Remote Code Execution
< 2.1.3 < 2.2.0 Applications that do not use Rack::Directory
Jul 20, 2020
Critical
CVE-2020-8159
Open in new tab icon
Rails
Ruby on Rails Framework
Remote Code Execution
Rails 3.x Rails 2.x Rails > 4.x if using actionpack_page-cache <= 1.2.0
May 12, 2020
Critical
CVE-2019-5420
Open in new tab icon
Rails
Ruby on Rails Framework
Remote Code Execution
6.0.0.0 - <= 6.0.0.beta2 5.2.0.0 - <= 5.2.2.0
Mar 27, 2019
High
CVE-2019-5418
Open in new tab icon
Rails
Ruby on Rails Framework
Information Exposure
6.0.0 - <= 6.0.0.beta2 5.2.0 - <= 5.2.2.0 All of 4.x prior to HeroDevs 4.2 LTS All of 3.x prior to HeroDevs 3.2 LTS All of 2.x prior to HeroDevs 2.3
Mar 27, 2019
High
CVE-2019-5418
Open in new tab icon
Rails
Ruby on Rails Framework
No items found.
6.0.0 - <= 6.0.0.beta2 5.2.0 - <= 5.2.2.0 All of 4.x prior to HeroDevs 4.2 LTS All of 3.x prior to HeroDevs 3.2 LTS All of 2.x prior to HeroDevs 2.3
Mar 27, 2019
High
CVE-2016-2098
Open in new tab icon
Rails
Ruby on Rails Framework
Remote Code Execution
<= 3.2.22.1 <= 4.1.14.1 <= 4.2.5.1
Apr 7, 2016
High
CVE-2015-7581
Open in new tab icon
Rails
Ruby on Rails Framework
Cross-Site Scripting
< 5.0.0.beta1 <= 4.2.5.0 <= 4.1.14.0
Feb 15, 2016
High
CVE-2014-3483
Open in new tab icon
Rails
Ruby on Rails Framework
Denial of Service
<=4.0.6 <=4.1.3 Only for instances using PostgreSQL
Jul 7, 2014
High
CVE-2014-3482
Open in new tab icon
Rails
Ruby on Rails Framework
Denial of Service
<=3.2.18 Only for instances using PostgreSQL
Jul 7, 2024
Critical
CVE-2013-0277
Open in new tab icon
Rails
Ruby on Rails Framework
Remote Code Execution
3.0.0 - <3.1.0 2.0.0 - <2.3.17
Feb 12, 2013
High
CVE-2013-0156
Open in new tab icon
Rails
Ruby on Rails Framework
Remote Code Execution
<= 2.3.15 <= 3.0.19 <= 3.1.9 <= 3.2.10 Not affected: • applications using the yajl gem
Jan 13, 2013
High
CVE-2012-2695
Open in new tab icon
Rails
Ruby on Rails Framework
Command Injection
<=3.2.5 <=3.1.5 <=3.0.13
Jun 22, 2012
For more details on CVEs found in end-of-life software, visit our vulnerability directory.

What is Never-Ending Support?

Security icon
Security Fixes
A new version of NES for Rails will be released each time we find, validate, and fix a security issue.
Compatibility icon
Drop-In Compatibility
A direct replacement for your framework—no migrations, no rewrites, just ongoing support.
SLA Compliance icon
SLA Compliance
HeroDevs provides SLAs that ensure compliance by providing incident response and remediation in accordance with industry-standard regulations, including SOC 2, FedRAMP, PCI, and HIPAA.
Learn more.
Team of Experts icon
Team of Experts
NES for Rails is built with advisement and consultation of core team members from Rails.
Easy to install icon
Easy to Install
Our simple drop-in replacement means all you have to do is update your Gemfile and rebuild your project. No code changes or find & replace required.
Shield icon
Intellectual Property Protection
NES for Rails is not only secure; HeroDevs also offers enterprise-level protection for all products.
Learn more.

Why HeroDevs?

Built By Ruby on Rails Experts

Rails experts ensure NES for Rails is the same quality you have come to expect when using Ruby on Rails open source projects.
‍
We specifically design our NES for Rails product to work seamlessly and ensure it is as dependable as the original Rails projects you built your applications on.

Give back to open source icon
We Give Back To Open Source

HeroDevs is deeply committed to the open-source community. We give support through sponsorships, backing core contributors, and funding events that drive the ecosystem forward. Our engagement extends beyond financial contributions, embodying a commitment to the ongoing growth and innovation of open-source software. This holistic support ensures the vitality of the open-source movement, fostering an environment of collaboration and advancement.

Support

Frequently Asked Questions

Below are common questions our customers have. Of course, we’re happy to meet with you and answer these and other questions you might have.
Does HeroDevs have an SLA for NES for Rails?
What Rails versions does NES support?
Does NES for Rails help with compliance?
Why do I need NES for Rails?
How does licensing work?
I got an error like "EOL/Obsolete Software: Rails 3.2 Detected." What can I do?

Related Products

If you're leveraging this technology, chances are you're also using complementary systems that face similar end-of-life (EOL) challenges.

Explore our related NES products that offer proactive, comprehensive support for your entire tech stack to ensure continuity, security, and innovation across all your essential technologies.

Contact Us

Got questions about Never-Ending Support for your open-source library? We're here to help!

Discover how HeroDevs NES Products can keep your systems secure and compliant.

Learn how our solutions can deliver value to your organization.

Get detailed pricing information tailored to your needs.

Trusted by industry leaders such as
Microsoft LogoBank Santander Logo SAP LogoGeneral Electric LogoFinra LogoUnqork LogoGoogle LogoValid 8 logoQueenslandRail logoGSA logoDepartment of Health logo
Talk to an Expert

By clicking "submit" I acknowledge receipt of our Privacy Policy.

Thank you! Your submission has been received!
Please enter a company email.

By clicking "Accept", you agree to the storing of cookies on your device to enhance site navigation, analyze site usage, and assist in our marketing efforts. View our Privacy Policy for more information.

Manage Consent Preferences by Category
Essentials
Always active

Necessary for the site to function. Always On.

Used for targeted advertising.

Remembers your preferences and provides enhanced features.

Measures usage and improves your experience.

Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.

AltStyle によって変換されたページ (->オリジナル) /