Skip to main content
All updates

AWS AMI 2026-09-03

The EC2 scope AMIs null-runtime-92 (x86) and null-runtime-arm-22 (arm64) move the nginx sidecar to nginx 1.30.4, which fixes six known vulnerabilities.

Action required

The nginx in the previous AMIs is affected by the CVEs listed below. Move your EC2 scopes to the new AMIs and redeploy them.

Highlights​

  • Pinned agent. The AMI now runs the nullplatform agent at a fixed version (0.11.0) instead of the floating latest tag. It's the same image latest pointed to when this AMI shipped, so behavior doesn't change, but instances launched later get the same agent. You can still override it with NP_CONTROLPLANE_AGENT_IMAGE.

Fixes​

  • nginx. The nginx image baked into the AMI (np-nginx 1.3.5) is now built on nginx 1.30.4, which fixes CVE-2026-9256, CVE-2026-42055, CVE-2026-48142, CVE-2026-42533, CVE-2026-60005 and CVE-2026-56434.

GPU AMIs were not rebuilt in this release.

Upgrade​

The AMIs are shared with your AWS account. Find them by name (null-runtime-92 and null-runtime-arm-22), set their IDs in ami.id of your EC2 provider, and redeploy your scopes. Each scope keeps running the previous AMI until it's redeployed. To track that rollout, see AMI drift detection.