Nokogiri v1.19.4 - XML Parser Security Fixes

Nokogiri v1.19.4 was published on June 18, 2026, as a security release for the Ruby XML and HTML parser used in many web processing, CMS import, and ETL paths. The most operator visible change is on JRuby: XML::Schema now enforces NONET with default options, closing a gap where schema parsing could still fetch network resources. It is not marked as a prerelease.

The full release notes and downloads are on the GitHub release page.

For ETL jobs that validate supplier XML against schemas, this is the change to check first. Before v1.19.4, XML::Schema on JRuby did not enforce the NONET parse option even though Nokogiri enables it by default. A schema parsed with default options could still fetch external resources over the network.

That matters in ingestion workers because XML validation often sits near untrusted partner data. The advisory calls out SSRF and XXE risk, plus a bypass of the CVE-2020-26247 mitigation. After this release, network access during schema parsing should be closer to the default CRuby expectation: parse without remote fetches unless the caller explicitly changes parser behavior.

This is especially relevant for JRuby services running inside private networks. A parser that can reach link local metadata, internal control planes, or private schema hosts is not just a parser problem. It becomes part of the service network surface.

Most of the release is CRuby native extension hardening. The notes list low severity fixes for memory hazards around object copies, XPath contexts, XInclude, document roots, attributes, and encoding changes.

The practical value is process stability in less common XML mutation paths. Nokogiri fixed a possible invalid memory read when XML::Node#initialize_copy_with_args receives an argument that is not a Node. It also fixed use after free cases involving XML::XPathContext after the source document is garbage collected, XInclude processing through Node#do_xinclude, Document#root= with a non element node, attribute writes via XML::Attr#value= or #content=, and Document#encoding= when an exception is raised.

For web scraping and CMS migration jobs, these are not new parser features. They reduce crash and memory exposure paths when code mutates parsed trees, copies nodes, expands includes, or rewrites attributes during cleanup.

The release also fixes two direct crash style cases that are easy to miss in normal test data. XML::NodeSet#[], also exposed as #slice, had an out of bounds read when given a large negative index. That is a small API surface, but it is reachable from ordinary Ruby code that slices query results.

Nokogiri also changed behavior for uninitialized wrapper objects. Methods called on wrappers created through paths such as allocate now raise instead of crashing the process. That is the correct failure mode for a library sitting inside long running import workers. Bad object state should become an exception the job can report, not a native crash that removes the worker from the queue.

In batch pipelines, these failures tend to show up as rare poison records or odd plugin behavior. The fix is still worth taking because it changes failure handling from process death to Ruby level control flow.

The release notes include SHA256 sums for the published gems. That includes CRuby platform packages such as x86_64-linux-gnu, x86_64-linux-musl, aarch64-linux-gnu, arm64-darwin, and x64-mingw-ucrt, plus the nokogiri-1.19.4-java.gem artifact.

Operators who mirror Ruby gems into internal registries can use those checksums during promotion. The release is security focused, so pinning both version and artifact digest is the clean path for controlled rollout. If a pipeline builds images for multiple Ruby runtimes, check both the CRuby and JRuby artifacts that apply to your fleet.