Decaf Blog In-depth updates on Decaf software, tooling, and open-source experiments

Nokogiri v1.19.4 - Parser Memory Safety Fixes

4 min read

Nokogiri v1.19.4 was published on June 18, 2026, with a compact set of security fixes for Ruby XML and HTML parsing paths. The main change for data engineering teams is not a new parser feature, but safer behavior when malformed objects, schema parsing, XInclude processing, and XPath contexts meet long running extraction jobs.

The full release notes and downloads are on the GitHub release page.

CRuby parser memory fixes

Most of this release is about CRuby memory safety. That matters in ETL and web scraping systems because Nokogiri often sits at the boundary between external markup and internal data models. A parser crash in that layer can take out a worker, lose batch progress, or trigger a retry storm that hides the real input problem.

The release fixes a possible invalid memory read when XML::Node#initialize_copy_with_args receives an argument that is not a Node. In pipeline terms, this is defensive handling around object copying, not a schema feature or selector behavior change. The related advisory is linked from the notes as the node copy advisory.

Several fixes address use-after-free cases across document and node operations. The affected areas include XML::XPathContext after its source document has been garbage collected, XInclude processing through Node#do_xinclude, Document#root= when assigned a non element node, attribute updates through XML::Attr#value= and #content=, and Document#encoding= when an exception is raised. For systems that parse many small documents in one process, these are exactly the code paths where lifetime bugs tend to appear under load.

Safer failure modes for bad objects

Nokogiri v1.19.4 also changes crash behavior for uninitialized wrapper objects. Methods called on objects created through paths such as allocate now raise instead of crashing the process. That is a better failure mode for background jobs because application code can log the record, fail the item, and let the supervisor decide what happens next.

The release also fixes a medium severity out-of-bounds read in XML::NodeSet#[], also available as #slice, when given a large negative index. Web extraction code often uses node sets as arrays after CSS or XPath selection. A bad index should be an application bug, not a native memory read. The release notes link this item to the node set advisory.

None of these changes imply a new API shape. They are mostly guardrail work around native extension behavior. That is still operationally important because Nokogiri is commonly loaded inside Sidekiq jobs, Rails import tasks, custom crawlers, and batch parsers that run far longer than a single request.

JRuby schema parsing and network isolation

The JRuby item is the most direct platform operator change in the release. XML::Schema now enforces the NONET parse option, which Nokogiri enables by default. Before this fix, schema parsing on JRuby could still fetch external resources over the network under default options.

That gap matters for XML ingestion services. A schema parse that reaches the network can turn document validation into an SSRF or XXE path, and the release notes say the old behavior could bypass the mitigation for CVE-2020-26247. The advisory for this item is the JRuby schema advisory.

For data platforms that support both CRuby and JRuby, this is a good reminder to test parser security settings on every runtime actually used in production. A config default that works on one runtime is not useful if another runtime ignores it in the validation path.

Package verification details

The release includes SHA256 checksums for published gems on the GitHub release page. The listed packages cover Linux GNU and musl builds, Darwin builds, Windows UCRT, Java, and the generic Ruby gem.

For locked build images, this is useful supply chain metadata. Teams that vendor gems or mirror artifacts can compare checksums during image builds before pushing parser updates into crawler or import fleets. The release notes do not describe a breaking change, so the practical upgrade work is dependency pinning, artifact verification, and regression tests around XML schema validation, XInclude use, XPath selection, and any code that mutates document roots or attributes.

Where to get it