# When will the patch be available for CVE-2023-38552/39331/39332/44487 upgrading nodejs \>= 18.18.2
**URL:** https://discuss.elastic.co/t/when-will-the-patch-be-available-for-cve-2023-38552-39331-39332-44487-upgrading-nodejs-18-18-2/346356
**Category:** Elastic Security
**Created:** [November 3, 2023, 11:02am UTC](https://discuss.elastic.co/t/when-will-the-patch-be-available-for-cve-2023-38552-39331-39332-44487-upgrading-nodejs-18-18-2/346356 "2023-11-03T11:02:56Z")
**Posts on this page:** 10
**Page:** 1
### Author:  [@stanislasm](https://discuss.elastic.co/u/stanislasm)
#### Post date: [November 3, 2023, 11:02am UTC](https://discuss.elastic.co/t/when-will-the-patch-be-available-for-cve-2023-38552-39331-39332-44487-upgrading-nodejs-18-18-2/346356/1 "2023-11-03T11:02:56Z")
Hello,
When will the fix for CVE-2023-38552/39331/39332/44487 upgrading nodejs \>= 18.18.2 be available in the Kibana 8.10.x version?
Thanks
---
### Author:  [@Andrew\_G](https://discuss.elastic.co/u/Andrew_G)
#### Post date: [November 3, 2023, 2:05pm UTC](https://discuss.elastic.co/t/when-will-the-patch-be-available-for-cve-2023-38552-39331-39332-44487-upgrading-nodejs-18-18-2/346356/2 "2023-11-03T14:05:28Z")
Hi @stanislasm, [this pull request](https://github.com/elastic/kibana/pull/168972) merged Node `18.18.2` into the `8.10.x` branch.
The PR above merged _after_ the release of [Kibana 8.10.4](https://www.elastic.co/blog/elastic-stack-8-10-4-released), which is the latest `8.10.x` release. As a result of this timing, the next version of Kibana that includes Node `18.18.2` will be Kibana `8.11.0`. I can't promise a specicic date for the release of `8.11.0`, but it's expected to be available soon.
---
### Author:  [@stanislasm](https://discuss.elastic.co/u/stanislasm)
#### Post date: [November 3, 2023, 2:21pm UTC](https://discuss.elastic.co/t/when-will-the-patch-be-available-for-cve-2023-38552-39331-39332-44487-upgrading-nodejs-18-18-2/346356/3 "2023-11-03T14:21:28Z")
Hi @Andrew_G
Great, thank you for your response!
---
### Author:  [@San9](https://discuss.elastic.co/u/San9)
#### Post date: [November 14, 2023, 8:44am UTC](https://discuss.elastic.co/t/when-will-the-patch-be-available-for-cve-2023-38552-39331-39332-44487-upgrading-nodejs-18-18-2/346356/4 "2023-11-14T08:44:36Z")
@Andrew_G
Hello, can you tell me Kibana version 8.10.4 already with Node 18.18.2? otherwise my scanner complains that there is still an old version.
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [November 14, 2023, 9:11am UTC](https://discuss.elastic.co/t/when-will-the-patch-be-available-for-cve-2023-38552-39331-39332-44487-upgrading-nodejs-18-18-2/346356/5 "2023-11-14T09:11:38Z")
Kibana 8.11.1 is out, and I believe this should have the new version of node.js.
---
### Author:  [@San9](https://discuss.elastic.co/u/San9)
#### Post date: [November 14, 2023, 3:02pm UTC](https://discuss.elastic.co/t/when-will-the-patch-be-available-for-cve-2023-38552-39331-39332-44487-upgrading-nodejs-18-18-2/346356/6 "2023-11-14T15:02:49Z")
Yes, I already installed it.
Is it really possible to update this component separately? or too many dependencies?
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [November 14, 2023, 3:03pm UTC](https://discuss.elastic.co/t/when-will-the-patch-be-available-for-cve-2023-38552-39331-39332-44487-upgrading-nodejs-18-18-2/346356/7 "2023-11-14T15:03:51Z")
You should always look to keep Elasticsearch and Kibana on the same version. Other components are as far as I know generally less sensitive.
---
### Author:  [@San9](https://discuss.elastic.co/u/San9)
#### Post date: [November 14, 2023, 3:22pm UTC](https://discuss.elastic.co/t/when-will-the-patch-be-available-for-cve-2023-38552-39331-39332-44487-upgrading-nodejs-18-18-2/346356/8 "2023-11-14T15:22:55Z")
I mean node.js as a component in the kibana package.
Yes, that's right, the major and minor versions must match.
---
### Author:  [@Andrew\_G](https://discuss.elastic.co/u/Andrew_G)
#### Post date: [November 14, 2023, 9:58pm UTC](https://discuss.elastic.co/t/when-will-the-patch-be-available-for-cve-2023-38552-39331-39332-44487-upgrading-nodejs-18-18-2/346356/9 "2023-11-14T21:58:24Z")
Thanks all for the conversation above!
In summary:
- [Elastic Security 8.11.1](https://www.elastic.co/blog/whats-new-elastic-security-8-11-0), which includes node `18.18.2`, is available
- The previous `8.10.x` version of Kibana, `8.10.4`, was NOT tested with node `18.18.2`. In general, avoid paring Kibana with untested versions of node
- Always upgrade all components of the Elastic stack together, via [Elastic Cloud](https://www.elastic.co/guide/en/elastic-stack/current/upgrade-elastic-stack-for-elastic-cloud.html) or [the instructions for on-prem](https://www.elastic.co/guide/en/elastic-stack/current/upgrading-elastic-stack-on-prem.html)
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 12, 2023, 9:59pm UTC](https://discuss.elastic.co/t/when-will-the-patch-be-available-for-cve-2023-38552-39331-39332-44487-upgrading-nodejs-18-18-2/346356/10 "2023-12-12T21:59:23Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.