Skip to main content
All updates

AWS AMI 2026-07-02

The EC2 scope AMIs null-runtime-89 (x86) and null-runtime-arm-20 (arm64) let the nginx sidecar handle many more concurrent connections, such as WebSockets, and patch libssh2.

Action required

The nginx image in the previous AMIs carries the libssh2 vulnerabilities listed below. Move your EC2 scopes to the new AMIs and redeploy them.

Highlights​

  • More concurrent connections. Each nginx worker now accepts up to 16,384 connections (up from 1,024) and can open up to 32,768 file descriptors. Each WebSocket holds a connection open, so WebSocket-heavy workloads no longer hit the old limit.

Fixes​

  • libssh2. The nginx image baked into the AMI (np-nginx 1.3.4) patches CVE-2026-55199, CVE-2026-55200 and CVE-2026-7598.

Upgrade​

The AMIs are shared with your AWS account. Find them by name (null-runtime-89 and null-runtime-arm-20), set their IDs in ami.id of your EC2 provider, and redeploy your scopes. Each scope keeps running the previous AMI until it's redeployed. To track that rollout, see AMI drift detection.