Repository navigation
[FEEDBACK REQUEST] Node.js 26 preview #198
Description
Today, we have published the preview AWS Lambda Node.js 26 runtime. You can use it to build and deploy Node.js 26 Lambda functions in both deployment formats:
- Managed runtime (ZIP): select the
nodejs26.xruntime when deploying your function code as a.ziparchive. - Container image (OCI): build and deploy your function using the preview base image
public.ecr.aws/lambda/nodejs:26-preview.
Please share any feedback below! Thank you!
Activity
dtPaTh commentedon Aug 25, 2026
This is an awesome move. Allowing to testing upfront new runtime versions greatly reduces the risk of unwanted surprises.
willfarrell commentedon Aug 27, 2026
A draft of Middy v8 for the nodejs26 runtime is now live. Will be testing over the next few months on the new runtime.
aidant commentedon Sep 14, 2026
I am surprised to see
process.features.require_moduledisabled in thenodejs26.xruntime. While this restriction is documented behaviour for thenodejs20.x,nodejs22.x, andnodejs24.xruntimes in the experimental Node.js features section. The feature has since stabilised in Node.js v24 and Node.js v26. Is there a reason this feature is still disabled or will it be enabled by default beforenodejs26.xis released?ahtcx commentedon Sep 24, 2026
I noticed
Temporalis absent too, is it planned for the stable release?Flarna commentedon Sep 24, 2026
Not sure if this is specific to node.js 26 runtime.
I found the env var
AWS_ACCOUNT_IDis set which was not the case in the past. It is not documented here so don't know if this is an oversight or intentionally added.Would be really cool if it is intentional and will stay.
WilliamABradley commentedon Sep 28, 2026
I was expecting Temporal to be enabled since it was made stable with Node 26, what has changed in this release, just the underlying Runtime updates, e.g. V8?
TheHolyWaffle commentedon Oct 9, 2026
Based on my own testing, it looks like both Node.js 24 and 26 now receive the
AWS_ACCOUNT_IDenvironment variable, not just Node.js 26.I've confirmed this for the following runtimes:
GDownes commentedon Oct 23, 2026
Could the Lambda team confirm the managed ZIP runtime rollout for the Node.js 26.12.1 security release, including CVE-2026-111497?
Observed on 23 October 2026 in
eu-west-1,arm64, with runtimenodejs26.xand runtime updates set toAuto:UpdateFunctionConfigurationcompleted successfully, but the managed runtime remainednodejs:26.mainline.v36.arn:aws:lambda:eu-west-1::runtime:42b3336b25ed2b5e19eb732daab02886146c028d1588dc7d47301c0b5ad7c19d.INIT_STARTin the same log stream, report Node26.8.2, Brotli1.2.0, and Undici8.10.2. A fresh initialization after the configuration update reports the same versions.public.ecr.aws/lambda/nodejs:26-previewimage, resolved tosha256:7da158022889eda783e336535b17adc063f0e03f34f44abf88d660be193c2860, reports Node26.12.1, Brotli1.2.0, and Undici8.12.2when executed on arm64.The Node.js 26.12.1 release includes the Brotli fix. We understand that the Brotli version string alone cannot establish whether a backport is present.
Does managed runtime
nodejs:26.mainline.v36include the CVE-2026-111497 fix despite its older Node version? If so, could you provide a patch mapping or other confirmation? Otherwise, when should the patched managed runtime become available foreu-west-1arm64, and which runtime-version ARN identifies it?We recognize that Node.js 26 is currently a Lambda preview runtime; this is a request for patch status through the documented preview feedback channel.