Published November 12, 2026. AWS updated its bulletin on November 11 at 20:05 UTC; this is not a new incident.
AWS reports affected TLS certificates removed from Lambda managed ZIP runtimes. Email/object-verification removal is complete for Node.js 22/24/26, with others expected by November 17. Function updates can pick up that change from November 11.
Why that distinction matters
A successful HTTPS request does not demonstrate that a mail or signed-object verification path uses the intended trust policy. Treat those as separate checks. First identify what the function actually verifies, then identify the library and certificate store responsible. A deployment label saying “Node.js 24” is not a patch receipt.
AWS documents a separate runtime-version identifier and ARN, distinct from the language identifier. The current ARN can be checked in the Lambda console or the INIT_START log entry. Record this evidence with the deployment rather than relying on a language-version screenshot.
A small, reviewable deployment checklist
- Inventory the delivery path. Separate managed ZIP functions from container deployments. Note the runtime update mode, owners and any application-supplied trust stores.
- Use the supported update path. AWS directs container users to rebuild and redeploy with the latest image. A new base image sitting in a registry does not change a running function.
- Test both acceptance and rejection. In a non-production test, check a valid approved certificate chain and a deliberately untrusted fixture. Use synthetic messages or objects, not customer records. Keep normal certificate verification enabled.
- Keep deployment evidence. Record the runtime ARN or built image digest, the tested verification paths and the result. Escalate unexpected failures rather than restoring a distrusted certificate to make a test pass.
Do not close the ticket from a calendar date
November 17 is AWS’s stated expectation, not evidence that every relevant function has already changed. Review runtime-management settings before planning an update; manual controls and application dependencies deserve an explicit check. The practical completion criterion is the deployed version plus the behavior your application needs.
This is a documentation-based operational analysis. We have not accessed or tested a reader’s AWS environment, and do not claim the pending rollout is complete.