# Fluentd v1.19.4

> Observability · 2026-09-28

A maintenance release centered on bug fixes, including a path-traversal security correction. It also changes the syslog message-size default and adds HTTP authentication and network allowlisting capabilities.

## Action needed
- **[security]** Complete path traversal checking in `extract_placeholders`
  - The output path traversal check in `extract_placeholders` now handles the previously incomplete case.
- **[breaking]** Decompression size enforcement on the buffer chunk I/O path
  - The buffer chunk I/O path now enforces `decompression_size_limit`.

## Check if affected
- **[breaking]** `message_length_limit` enforcement for syslog TCP and TLS transports
  - Applicability is not stated in the release notes.
  - The `in_syslog` plugin now enforces `message_length_limit` on TCP and TLS transports.
- **[breaking]** The `message_length_limit` default, increased to 8192
  - Applies if you do not configure `message_length_limit`.
  - The default `message_length_limit` changes from 2048 to 8192, matching rsyslog's default `MaxMessageSize`.

## Other recorded changes
- 17 (defect_corrected 13, added 2, value_changed 1, constraint_changed 1)

[Full analysis](https://ratatosk.io/en/releases/fluentd/v1.19.4)

[Original release notes](https://github.com/fluent/fluentd/releases/tag/v1.19.4)