# Potential security issues with the bundled node.js

**URL:** <https://forum.opensearch.org/t/potential-security-issues-with-the-bundled-node-js/17365>\
**Category:** OpenSearch Dashboards\
**Tags:** cve\
**Created:** [January 8, 2024, 3:24pm UTC](https://forum.opensearch.org/t/potential-security-issues-with-the-bundled-node-js/17365 "2024-01-08T15:24:18Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![chrisbra](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/chrisbra/32/6793_2.png) [@chrisbra](https://forum.opensearch.org/u/chrisbra)\
**Post date:** [January 8, 2024, 3:24pm UTC](https://forum.opensearch.org/t/potential-security-issues-with-the-bundled-node-js/17365/1 "2024-01-08T15:24:18Z")

</div>

**Versions** (relevant - OpenSearch/Dashboard/Server OS/Browser):  
2.11.0

**Describe the issue** :  
I got a report, that the bundled node in opensearch dashboards (which seems to be `18.6.0` up to OSD v2.11.1 is vulnerable to the following CVEs (at least):

- CVE-2023-45143 (critical)
- CVE-2023-32002 (critical)  
(and a few more), recommendation is to upgrade node to at least 18.18.2 to fix all those issues.

Considering that even the latest version of OSD 2.11.1 still includes node.js 18.6.0, is the `node` binary actually needed? What is that used for?

Also, I checked the environment, `node` isn’t even exectuable there since the OS is too old:

```auto
/usr/share/opensearch-dashboards/node/bin/node --version
/usr/share/opensearch-dashboards/node/bin/node: /lib64/libm.so.6: version `GLIBC_2.27' not found (required by /usr/share/opensearch-dashboards/node/bin/node)
/usr/share/opensearch-dashboards/node/bin/node: /lib64/libc.so.6: version `GLIBC_2.25' not found (required by /usr/share/opensearch-dashboards/node/bin/node)
/usr/share/opensearch-dashboards/node/bin/node: /lib64/libc.so.6: version `GLIBC_2.28' not found (required by /usr/share/opensearch-dashboards/node/bin/node)
/usr/share/opensearch-dashboards/node/bin/node: /lib64/libstdc++.so.6: version `CXXABI_1.3.9' not found (required by /usr/share/opensearch-dashboards/node/bin/node)
/usr/share/opensearch-dashboards/node/bin/node: /lib64/libstdc++.so.6: version `GLIBCXX_3.4.20' not found (required by /usr/share/opensearch-dashboards/node/bin/node)
/usr/share/opensearch-dashboards/node/bin/node: /lib64/libstdc++.so.6: version `GLIBCXX_3.4.21' not found (required by /usr/share/opensearch-dashboards/node/bin/node)

```

Any ideas please?

---

<div class="post-metadata">

**Author:** ![nap608](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/nap608/32/7155_2.png) [@nap608](https://forum.opensearch.org/u/nap608)\
**Post date:** [April 26, 2024, 9:43pm UTC](https://forum.opensearch.org/t/potential-security-issues-with-the-bundled-node-js/17365/2 "2024-04-26T21:43:13Z")

</div>

any reply?

---

<div class="post-metadata">

**Author:** ![nardixcx](https://avatars.discourse-cdn.com/v4/letter/n/6bbea6/32.png) [@nardixcx](https://forum.opensearch.org/u/nardixcx)\
**Post date:** [May 5, 2024, 5:49am UTC](https://forum.opensearch.org/t/potential-security-issues-with-the-bundled-node-js/17365/3 "2024-05-05T05:49:50Z")

</div>

same issue here

---

<div class="post-metadata">

**Author:** ![chrisbra](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/chrisbra/32/6793_2.png) [@chrisbra](https://forum.opensearch.org/u/chrisbra)\
**Post date:** [May 5, 2024, 5:08pm UTC](https://forum.opensearch.org/t/potential-security-issues-with-the-bundled-node-js/17365/4 "2024-05-05T17:08:23Z")

</div>

In the end I followed the suggestion [here](https://github.com/opensearch-project/OpenSearch-Dashboards/blob/main/SECURITY.md#reporting-a-vulnerability) and reported it to [aws-security@amazon.com](mailto:aws-security@amazon.com)

After some weeks, they eventually replied ans answered that those CVEs do not apply here and opensearch-dashboards is not vulnerable to those.