HeroDevs Launches Evergreen for Application-Wide CVE Remediation

As AI accelerates CVE discovery, Evergreen finds every unsupported dependency in your Java, JavaScript, and .NET applications and opens a ready-to-merge pull request with a CVE-free, drop-in replacement.

SANDY, Utah, Nov. 5, 2026 /PRNewswire/ -- HeroDevs, the leader in CVE remediation and commercial open source support at the application layer, today announced Evergreen. The launch comes as frontier AI models make finding vulnerabilities fast and cheap, pushing CVE volume past what engineering teams can work through. Evergreen continuously tracks the health of open source dependencies across an entire application. When a CVE lands on a dependency that no longer gets upstream fixes, Evergreen automatically delivers a CVE-free, drop-in replacement backed by a 14-day SLA, across every application an organization builds using Java, JavaScript, or .NET.

Most CVEs get resolved with a version bump. The CVEs that stay open and take the most engineering effort often sit on a version that no longer gets upstream fixes. Closing those CVEs takes a major upgrade or a patch written and maintained in-house, pulling engineers off the product roadmap. The challenge is structural, not temporary: Sonatype's 2026 State of the Software Supply Chain Report found 81,000+ open source package versions already carrying a known CVE with no upstream fix path. With Evergreen, engineering teams close CVEs without a major upgrade: a CVE-free, drop-in replacement arrives automatically as a pull request in the team's existing workflow. HeroDevs patches every CVE on dependencies that no longer get upstream fixes. HeroDevs keeps patching the drop-in replacement as new CVEs land, so engineering teams stay secure in place across the entire application.

For AppSec and compliance teams, a CVE on a version that no longer gets upstream fixes is a finding that stays open. Each open finding is a persistent risk in production that AppSec teams answer for but cannot close on their own. Security scanners keep reporting CVEs, and Evergreen works alongside them, tracking which findings sit on unsupported versions and delivering a replacement that closes each finding. Every remediation arrives with a VEX statement and a legal attestation, evidence AppSec and compliance teams can hand to auditors for frameworks such as FedRAMP, PCI, SOC 2, HIPAA, CRA, and more.

"AI has made finding vulnerabilities fast and cheap, but what we still see is remediation happening one CVE at a time," said Aaron Mitchell, CEO of HeroDevs. "That approach worked when CVEs arrived at a pace teams could keep up with. At more than 260 new CVEs a day, every CVE handled on its own is another project that pulls engineers off the roadmap. We built Evergreen on a new premise: customers should be able to secure their entire application, not just one CVE at a time. For the engineering team, what used to be a new project becomes a pull request to review and merge."

More than 1,000 organizations, including half of the Fortune 100, already rely on HeroDevs for CVE remediation in the open source libraries their applications depend on. Evergreen, available today, extends the same CVE remediation from individual libraries to the entire application dependency tree. Every remediation is reviewed and tested by open source maintainers, including the original maintainers of widely used frameworks. Almost every application runs open source that no longer gets upstream fixes, and with Evergreen, teams migrate off that open source when they choose to, not when a CVE forces the move. Engineering and security teams can start with a free exposure report on an application's open source dependencies.

Evergreen is available today. Watch this video to learn more about Evergreen or contact us to schedule a demo. 

About HeroDevs
HeroDevs is the leader in ensuring the open source dependencies organizations rely on are always secure and always supported. HeroDevs builds CVE-free, drop-in replacements for open source libraries from AngularJS to Spring and .NET, so businesses can plan migrations on their terms while staying protected against vulnerabilities and compliance requirements.

SOURCE HeroDevs