Does HeroDevs have an SLA for NES for Rails?

Yes. Our response times vary based on the severity of the issue. Security-related and application-breaking issues are our top priority and will be resolved immediately (same day if possible). We can provide our SLA for your team to review upon request.

What Rails versions does NES support?

NES for Rails supports versions 2.3, 3.2, 4.2, 5.2, and 6.1. We provide ongoing support and patches to keep your applications secure and operational.

Does NES for Rails help with compliance?

NES for Rails helps maintain compliance by providing security patches and updates, even for older versions. Additionally, our enterprise-grade SLA stands up to HIPAA, SOC-2, PCI DSS, etc., and ensures your compliance with these standards. Many CVEs may affect Rails versions 2.3, 3.2, 4.2, 5.2, and 6.1—and we address those for you.

Why do I need NES for Rails?

Using an unsupported version of Rails exposes your applications to security vulnerabilities and compliance risks. Upgrading to the latest version can be costly and time-consuming. Never-Ending Support (NES) for Rails allows you to stay on your current version and remain supported until you are ready to upgrade.

How does licensing work?

When you purchase Never-Ending Support, you acquire a commercial license for the support services. Our pricing model is based on the number of users who will be committing code to the project repo. Users are unnamed and transferable across team members.

I got an error like "EOL/Obsolete Software: Rails 3.2 Detected." What can I do?

This means your application is running Rails 3.2, which has reached end-of-life and no longer receives security updates—making it vulnerable to exploits. Rails NES provides a drop-in replacement to keep your application secure, compliant, and fully supported. Talk to our sales team to explore your options.

Secure drop-in replacements for Rails versions 2.3, 3.2, 4.2, 5.2, and 6.1

NEVER-ENDING SUPPORT FOR
Rails

Name: NES for Rails
Brand: HeroDevs
Rating: 5 (21 reviews)

Legacy Rails versions still function after support ends — but that's not good enough for internal SLAs, CVE disclosures, and security audits.

Never-Ending Support (NES) for Rails keeps you compliant, secure, and audit-ready without an unplanned migration or risky patchwork.

Get Pricing

View Docs

NES for Rails

is a secure drop-in replacement for

Rails

and takes just a few minutes to set up.

Step 1

Update your project’s Gemfile

Step 2

Set your token in your project’s local .gemrc file

Step 3

Install & run!

CVE Protection

0 Security Issues Fixed in NES for Rails
(and always watching for more)

By purchasing Never-Ending Support for Rails from HeroDevs, you’re ensuring that your Rails application stays secure and these vulnerabilities are mitigated. As more CVEs are discovered, you can rest easy knowing HeroDevs has remediated those issues before they’re ever announced publicly.

If you’re currently using Rails in your application’s tech stack, your application is vulnerable to the CVEs listed below.

Switch to NES for Rails in minutes to mitigate these vulnerabilities immediately.

Severity

ID

Technology

Libraries Affected

Category

Version(s) Affected

Published Date

Medium

CVE-2025-49007

Rails

Rack

Regular Expression Denial of Service

>=3.1.0 <3.1.16

Jun 26, 2025

Medium

CVE-2025-27111

Rails

Rack

Log Injection

<2.2.12, <3.0.13, <3.1.11

Mar 4, 2025

Medium

CVE-2025-25184

Rails

Rack

Improper Output Neutralization for Logs

<2.2.11, <3.0.12, <3.1.10

Feb 14, 2025

High

CVE-2024-26142

Rails

Ruby on Rails Framework

Denial of Service

7.1.0.0 to 7.1.3.0

Feb 27, 2024

High

CVE-2023-22794

Rails

Ruby on Rails Framework

Remote Code Execution

<=6.0.6.0 <=6.1.7.0 <=7.0.4.0

Feb 9, 2023

Critical

CVE-2022-30123

Rails

Ruby on Rails Framework

Remote Code Execution

2.2.0.0 - <=2.2.3.0 2.1.0.0 - <=2.1.4.0 2.0.0.0 - <=2.0.9.0

Dec 5, 2022

Critical

CVE-2022-21831

Rails

Ruby on Rails Framework

Remote Code Execution

7.0.0.0 - <= 7.0.2.2 6.1.0.0 - <= 6.1.4.6 6.0.0.0 - <= 6.0.4.6 5.2.0.0 - <= 5.2.6.2

May 26, 2022

Critical

CVE-2020-8165

Rails

Ruby on Rails Framework

Remote Code Execution

6.0.0 - <= 6.0.3.0 5.0.0 - <= 5.2.4.2

Jun 19, 2020

High

CVE-2020-8163

Rails

Ruby on Rails Framework

Remote Code Execution

<= 5.0.0 Not affected: Applications that do not allow users to control the names of locals. <= 4.2.11.1

Jul 2, 2020

High

CVE-2020-8162

Rails

Ruby on Rails Framework

Authorization Bypass

<= 5.2.4.1 <= 6.0.3.0 Not affected: Applications that do not use the direct upload functionality of the ActiveStorage S3 adapter.

Jun 19, 2020

High

CVE-2020-8161

Rails

Ruby on Rails Framework

Remote Code Execution

< 2.1.3 < 2.2.0 Applications that do not use Rack::Directory

Jul 20, 2020

Critical

CVE-2020-8159

Rails

Ruby on Rails Framework

Remote Code Execution

Rails 3.x Rails 2.x Rails > 4.x if using actionpack_page-cache <= 1.2.0

May 12, 2020

Critical

CVE-2019-5420

Rails

Ruby on Rails Framework

Remote Code Execution

6.0.0.0 - <= 6.0.0.beta2 5.2.0.0 - <= 5.2.2.0

Mar 27, 2019

High

CVE-2019-5418

Rails

Ruby on Rails Framework

Information Exposure

6.0.0 - <= 6.0.0.beta2 5.2.0 - <= 5.2.2.0 All of 4.x prior to HeroDevs 4.2 LTS All of 3.x prior to HeroDevs 3.2 LTS All of 2.x prior to HeroDevs 2.3

Mar 27, 2019

High

CVE-2019-5418

Rails

Ruby on Rails Framework

No items found.

6.0.0 - <= 6.0.0.beta2 5.2.0 - <= 5.2.2.0 All of 4.x prior to HeroDevs 4.2 LTS All of 3.x prior to HeroDevs 3.2 LTS All of 2.x prior to HeroDevs 2.3

Mar 27, 2019

High

CVE-2016-2098

Rails

Ruby on Rails Framework

Remote Code Execution

<= 3.2.22.1 <= 4.1.14.1 <= 4.2.5.1

Apr 7, 2016

High

CVE-2015-7581

Rails

Ruby on Rails Framework

Cross-Site Scripting

< 5.0.0.beta1 <= 4.2.5.0 <= 4.1.14.0

Feb 15, 2016

High

CVE-2014-3483

Rails

Ruby on Rails Framework

Denial of Service

<=4.0.6 <=4.1.3 Only for instances using PostgreSQL

Jul 7, 2014

High

CVE-2014-3482

Rails

Ruby on Rails Framework

Denial of Service

<=3.2.18 Only for instances using PostgreSQL

Jul 7, 2024

Critical

CVE-2013-0277

Rails

Ruby on Rails Framework

Remote Code Execution

3.0.0 - <3.1.0 2.0.0 - <2.3.17

Feb 12, 2013

High

CVE-2013-0156

Rails

Ruby on Rails Framework

Remote Code Execution

<= 2.3.15 <= 3.0.19 <= 3.1.9 <= 3.2.10 Not affected: • applications using the yajl gem

Jan 13, 2013

High

CVE-2012-2695

Rails

Ruby on Rails Framework

Command Injection

<=3.2.5 <=3.1.5 <=3.0.13

Jun 22, 2012

For more details on CVEs found in end-of-life software, visit our vulnerability directory.

Vulnerability Directory

Report A Vulnerability

What is Never-Ending Support?

Security Fixes

A new version of NES for Rails will be released each time we find, validate, and fix a security issue.

Drop-In Compatibility

A direct replacement for your framework—no migrations, no rewrites, just ongoing support.

SLA Compliance

HeroDevs provides SLAs that ensure compliance by providing incident response and remediation in accordance with industry-standard regulations, including SOC 2, FedRAMP, PCI, and HIPAA.

Learn more.

Team of Experts

NES for Rails is built with advisement and consultation of core team members from Rails.

Easy to Install

Our simple drop-in replacement means all you have to do is update your Gemfile and rebuild your project. No code changes or find & replace required.

Intellectual Property Protection

NES for Rails is not only secure; HeroDevs also offers enterprise-level protection for all products.

Learn more.

Why HeroDevs?

Built By Ruby on Rails Experts

Rails experts ensure NES for Rails is the same quality you have come to expect when using Ruby on Rails open source projects.
‍
We specifically design our NES for Rails product to work seamlessly and ensure it is as dependable as the original Rails projects you built your applications on.

We Give Back To Open Source

HeroDevs is deeply committed to the open-source community. We give support through sponsorships, backing core contributors, and funding events that drive the ecosystem forward. Our engagement extends beyond financial contributions, embodying a commitment to the ongoing growth and innovation of open-source software. This holistic support ensures the vitality of the open-source movement, fostering an environment of collaboration and advancement.

Support

Frequently Asked Questions

Below are common questions our customers have. Of course, we’re happy to meet with you and answer these and other questions you might have.

Related Products

If you're leveraging this technology, chances are you're also using complementary systems that face similar end-of-life (EOL) challenges.

Explore our related NES products that offer proactive, comprehensive support for your entire tech stack to ensure continuity, security, and innovation across all your essential technologies.

View All Products

AngularJS

Node.js

Spring

HeroDevs Blog