← Back to changelog

2026-10-30

New EKS node image closes containerd image-pull vulnerabilities

#kubernetes  #eks  #aws  #security  #update  #upgrade 

All clusters, non-production and production, now run EKS node image v20261026. It moves the container runtime to containerd 2.3.7, which fixes CVE-2026-95839, CVE-2026-53493 and related image-pull issues. Each one needs a node to pull a crafted image, so images from registries you trust were never a risk; this update closes the gap before it matters.

Risk this resolves

Pulling a crafted image, or any image from a malicious registry, could take down container operations on the node that pulls it:

  • CVE-2026-95839: a manifest with a malformed digest crashes containerd. Since the kubelet retries failed pulls, one pod referencing such an image keeps crashing containerd on its node.
  • CVE-2026-53493: a deeply nested image index makes containerd use unbounded CPU and memory during the pull.
  • GHSA-hc94-p972-ch66: a layer that streams more data than it declares fills the node’s disk, which puts the node under disk pressure and blocks new pods.

Running containers kept working in each case, but no new pod could start on the affected node until containerd recovered.

What changed

  • Every node was replaced once. Karpenter moved your workloads to nodes on the new image within your node pools’ disruption budgets, as in any node rotation.
  • containerd 2.3.7 and kernel patch updates. The container runtime moves from 2.3.5 to 2.3.7, and nodes pick up the latest patch release of their kernel line. The Kubernetes version of your nodes does not change.

There is nothing for you to do.

Component upgrades