Skip to main content
All updates

AWS AMI 2026-03-09

The EC2 scope AMIs null-runtime-82 (x86) and null-runtime-arm-13 (arm64) patch critical and high vulnerabilities in the container runtime and in nginx.

Action required

The previous AMIs carry the vulnerabilities listed below. Move your EC2 scopes to the new AMIs and redeploy them.

Fixes​

  • containerd. The AMI now installs containerd.io 1.7.29 or later from Docker's official repository, which fixes CVE-2024-25621 (local privilege escalation) and CVE-2025-64329 (memory exhaustion through CRI Attach).
  • Docker Compose. Upgraded to 5.0.2, which fixes CVE-2024-41110 and CVE-2024-45337 (both critical).
  • nginx. The nginx image baked into the AMI (np-nginx 1.3.2) moves to nginx 1.29.5 and patches libpng: CVE-2026-22695, CVE-2026-22801 and CVE-2026-25646.

Upgrade​

The AMIs are shared with your AWS account. Find them by name (null-runtime-82 and null-runtime-arm-13), set their IDs in ami.id of your EC2 provider, and redeploy your scopes. Each scope keeps running the previous AMI until it's redeployed. To track that rollout, see AMI drift detection.