AWS CodeBuild: Unknown runtime version named '20' of nodejs

Phase context status code: YAML_FILE_ERROR Message: Unknown runtime version named '20' of nodejs. This build image has the following versions: 22, 24, 26

Short answer: AWS removed Node.js 18 and 20 from CodeBuild images on 28–30 October 2026, so a buildspec asking for nodejs: 18 or 20 now fails before the build starts. The trigger was the Node.js Brotli flaw CVE-2026-111497, which end-of-life versions never get fixed. Change runtime-versions to nodejs: 22 or 24 (the image default), fix what your dependencies flag, and run the build again.

Why it happens

AWS security bulletin 2026-155-AWS (28 October 2026, updated 30 October) rebuilt the curated CodeBuild images with patched Node.js 22.23.4, 24.22.1 and 26.12.1, and says the updated images "no longer include Node.js 18 or 20". Both lines are end-of-life and get no fix for CVE-2026-111497, a high-severity flaw in the Brotli decoder. CodeBuild checks runtime-versions against the image before it runs any of your commands, so the build stops in the DOWNLOAD_SOURCE phase with YAML_FILE_ERROR. CodeBuild has printed this message format for years (a 2022 log shows the same text for Node.js 12). The list at the end is what your image offers: on every current Linux standard image that is 22, 24 and 26.

You may also see

Phase context status code: YAML_FILE_ERROR Message: Unknown runtime version named '18' of nodejs. This build image has the following versions: 22, 24, 26

Phase complete: DOWNLOAD_SOURCE State: FAILED

Fix

Find every buildspec that still asks for the old version: grep -rnE "nodejs: *['\"]?(18|20)" --include="*.yml" --include="*.yaml" . Also check buildspecs saved in the CodeBuild project itself (console → project → Edit → Buildspec), in CDK (BuildSpec.fromObject) and in CloudFormation or Terraform templates. A CodePipeline build stage runs a CodeBuild project, so the fix goes in that project's buildspec.

Change the version in the install phase:

phases:
  install:
    runtime-versions:
      nodejs: 22   # was 20. 24 is the image default; 26 is also available

Try the same version locally first: nvm install 22, delete node_modules, then npm ci and your tests. Native add-ons such as bcrypt or sharp need releases built for the newer Node.js, and node-sass has no build for Node.js 22, so move to the sass package. Update engines in package.json and .nvmrc if you use them.
Run the build again. If the project uses a custom image built on an AWS base image, rebuild it from the updated base. If it's pinned to a specific image version instead of the latest, point it at the current one: the bulletin asks for both.

Build still red after the switch, or many buildspecs to move? I move every buildspec and function still on Node.js 18 or 20 to 22, fix what breaks in your dependencies, test it and send you a pull request. No AWS keys needed.

Get it fixed: $49

Pay by card, no account needed. Pull request within 48 hours; build still failing, full refund. Prefer Fiverr?

Watch out

Don't stay on Node.js 20 by installing it yourself in the build, or by switching to a Lambda compute image (nodejs18 and nodejs20 are still listed there) or the Windows or macOS images. Node.js 20 reached end of life on 30 April 2026 and won't get a fix for CVE-2026-111497.
Always set the version. Without runtime-versions, CodeBuild uses the image default, which AWS changes when a version reaches end of life. Today the default is 24.
Node.js 22 reaches end of life on 30 April 2027. If your dependencies run on 24, it gives you an extra year.
Firebase also stopped deploying Node.js 20 functions on 30 October 2026: see Runtime Node.js 20 was decommissioned.

Sources

Did this fix it?

Other errors breaking soon

All "breaking soon" fixes