Rails 8.0.5.2 and 8.1.4.1 fix 21 flaws as 8.0 support nears its end

Rails 8.0.5.2 and 8.1.4.1 fix 21 flaws as 8.0 support nears its end

4 November 2026: The Ruby on Rails core team has released Rails 8.0.5.2 and 8.1.4.1 with fixes for 21 security issues, one of them critical, and says it strongly recommends upgrading as soon as possible. The same post sets a deadline: security support for the Rails 8.0 series ends on 7 November 2026, three days after the release, and versions older than 8.0 are already unsupported.

Not yet independently verified. The Rails post lists GitHub advisory identifiers rather than CVE numbers, and we have not opened each advisory; it makes no claim of exploitation. We will update this when it can be confirmed, and remove this note.

The critical and high-rated fixes

The release post, written by Mike Dalessio, lists the issues by GitHub advisory identifier:

• critical, GHSA-f3w6-w445-fwh9: arbitrary file write and read in Active Storage image analysis;
• high, GHSA-v924-7rp8-4mxh: arbitrary file read and remote code execution in Active Storage video previews, analysis and image processing;
• high, GHSA-wm3x-v3qw-4jh3: a Strong Parameters bypass through Parameters#each_key;
• high, GHSA-2gff-2mmg-m73p: IP address spoofing in Action Dispatch's RemoteIp through the Forwarded header, in 8.1 only;
• high, GHSA-8474-xrp6-wh69: denial of service in Active Support's safe_constantize.

Two of the top three sit in Active Storage, the part of Rails that handles uploaded files, which is exactly where attacker-supplied content enters an application.

The rest of the list

The medium and low issues cover cross-site scripting in Action View's text, highlight, strip_tags and tag helpers and in Active Support's MessagePack serializer (8.1 only); denial of service in Action Controller Live and in Active Storage's proxy and filename handling; an unsigned Content-Type and an unenforced size limit for direct uploads to Google Cloud Storage; a destroyed session that CacheStore could restore; a session cookie leak in Active Storage proxy mode; missing SameSite attributes on session cookies; cache poisoning through content negotiation; and signature replay in Action Mailbox's Mailgun ingress.

Upgrade order for Rails teams

• Apps on 8.1 should move to 8.1.4.1 now.
• Apps on 8.0 should take 8.0.5.2 now and schedule the move to 8.1, since fixes after 7 November will not be backported to 8.0.
• Apps on 7.x or older get none of these fixes and have no supported upgrade path short of moving to 8.0 or later.
• Apps that process uploads with Active Storage, especially image and video analysis, should treat the critical and first high fix as the priority and check the libraries they call for analysis and previews.

Sources

• Ruby on Rails blog: Rails 8.0.5.2 and 8.1.4.1 have been released, 4 November 2026