Merge "Fix security vulnerability" into nyc-dev