LoginSign Up
← Back to all sparks
Elasticsearch logo

Elasticsearch

DEVOPSINFRA · APIS
Velocity5.0

Search and analytics

elastic.co ↗

One Node.js Brotli bug and a compromised CA bundle force ten patches across the Elastic Stack.

securitysupply-chainnode-jstlsdenial-of-servicecve-patch
◆Current state
Elastic shipped 8.19.24, 9.4.9 and 9.5.6 on November 3 with a batch of advisories from ESA-2026-229 to ESA-2026-238. Most trace to two inherited components: a Brotli decoder flaw in the bundled Node.js runtime (CVE-2026-111497) that reaches Kibana, Maps Server, Heartbeat and Elastic Agent Synthetics, and a root store that still trusts eight eMudhra intermediates with leaked keys. Two Elastic-owned denial-of-service bugs, in APM Server's OTLP/HTTP intake and two phonetic encoders, round out the release.
◆Where it's heading
Elastic's recent feed is dominated by patch trains: each security batch fans one inherited flaw out across Kibana, Agent, Heartbeat and the Docker images. The newest item is a third-party community tool announced in the feed, not an Elastic release, so product direction beyond the 8.19 / 9.4 / 9.5 maintenance lines is not visible here.
◆Prediction
Expect further advisories as Node.js and base-image fixes keep flowing into the Synthetics and Kibana images; the entries do not show whether Elastic will stop bundling its own Node.js root store.

◆Recent moves

  1. 3d ago

    Bitext's lemmatizing analyzer plugin beats ES standard by 18.8% F1

    A vendor-disclosed community post benchmarking a third-party Apache-2.0 analyzer plugin against Elasticsearch's built-in ones on MIRACL English. Useful evidence for lexical-search tuning, but nothing Elastic shipped; the product's own last move is still the November 3 security batch.

    View source ↗
  2. 7d ago

    ESQueryStudio – an open-source query workbench for Elasticsearch and Spring Boot

    A community post announcing ESQueryStudio, an independent Apache-2.0 query workbench for Elasticsearch that embeds in Spring Boot apps or runs as a Chrome extension. It is not an Elastic release and changes nothing in the product, though it shows demand for query consoles outside Kibana.

    View source ↗
  3. 10d ago

    Elastic Maps Server 8.19.24, 9.4.9, 9.5.6 Security Update (ESA-2026-238)

    Maps Server inherits the Node.js Brotli out-of-bounds write, reachable only through responses from its configured Elasticsearch host. Elastic confirmed the decoder is reachable but did not reproduce code execution, so this is a patch-on-schedule item for most operators.

    View source ↗
  4. 10d ago

    Multiple Elastic Docker images 8.19.24, 9.4.9, 9.5.6 Security Update (ESA-2026-237)

    The widest advisory in the batch: the OS certificate bundle in APM Server, Beats, Elastic Agent, Logstash, connectors, Profiling and Maps Server images trusts eight eMudhra intermediates whose keys leaked. Any image-based deployment that relies on the default trust store needs the upgrade.

    View source ↗
  5. 10d ago

    APM Server 8.19.24, 9.4.9, 9.5.6 Security Update (ESA-2026-236)

    APM Server could be knocked over by an oversized OTLP/HTTP body, halting trace intake until restart. The fix caps decompressed bodies at 64 MiB per the OTLP spec, and with OTLP/HTTP on by default, every APM deployment is in scope.

    View source ↗
  6. 10d ago

    Elasticsearch 8.19.24, 9.4.9, 9.5.6 Security Update (ESA-2026-235)

    A heap-exhaustion bug limited to clusters using the koelnerphonetik or haasephonetik encoders of the analysis-phonetic plugin. Narrow reach, with a reindex workaround for those who cannot upgrade.

    View source ↗