Issue with Node.js Vulnerabilities (CVE-2025) in Kibana 8.18.0

debbbuu
Thu, 05 Jun 2025 10:48:34 +0000
Kibana

Hi,

As part of the vulnerability assessment (VA) scan on our ELK servers, we identified that the Node.js version is affected by multiple vulnerabilities. We are using a self-managed cluster.

Current Kibana Version: 8.18.0
Path: /usr/share/kibana/node/glibc-217/bin/node
Installed Node.js Version: 20.18.2

The reported CVE IDs are:

CVE-2025-23165

CVE-2025-23166

CVE-2025-23167

Our security team has suggested upgrading to an Node.js version greater than 20.19.2 / 22.15.1 / 23.11.1 / 24.0.2 or later.

How to check which Kibana version has which Node.js version?

Suggest if we have to upgrade the Kibana version to have latest Node.js. (This approach isn’t ideal, as it would require manual intervention each time a new VA / version is discovered.)

I would appreciate any guidance on this matter.

Thanks,
Suraj

4 posts - 3 participants