Server Release 4.9.8

Before Upgrading

See the CircleCI server 4.9 release notes and upgrade guide for this release.

If you mirror images to a private registry or run an air-gapped install, copy the new NGINX image before you upgrade. See Configuration Changes below.

If you create your Nomad clients with the nomad-aws or nomad-gcp modules from server-terraform, the 4.9.8 module defaults move your Nomad clients to Ubuntu 24.04 when you update the module version. See details below.

NOTE: Vault is being deprecated and will no longer be supported in server 5.0. Refer to our script for steps to migrate to Tink.

What’s New in Release 4.9.8

Updates

The default Linux VM images for Machine Provisioner and remote Docker jobs were updated in all regions for AWS (including GovCloud) and GCP. If you set machine_provisioner.providers.ec2.linuxAMI or machine_provisioner.providers.gcp.linuxImage, your own image stays in use for x86 Linux jobs.

Nomad client images now based on Ubuntu 24.04

We are publishing new images for AWS and GCP customers to address CVE-2026-98432 and CVE-2026-99999 in the Linux kernel.

Important: The new Nomad client images are now based on Ubuntu 24.04 instead of Ubuntu 22.04.

For AWS

The nomad-aws module in server-terraform now uses the CircleCI Server Nomad AMI for Ubuntu 24.04 by default. The default of machine_image_names changed from ["CircleCIServerNomad*"] (Ubuntu 22.04) to ["ServerNomadV2-*"]. The new AMI has Linux kernel 6.8.0-1069 with the fixes for CVEs mentioned above.

The default applies to the Nomad clients. It also applies to the Nomad servers when you set deploy_nomad_server_instances to true. The client startup script now installs the Docker package that matches the Ubuntu release, so it works on 22.04 and 24.04 AMIs.

For GCP

The nomad-gcp module in server-terraform now boots Nomad clients from the CircleCI Server Nomad client image for GCP by default. The default of machine_image_project changed from ubuntu-os-cloud to circleci-images. The default of machine_image_family changed from ubuntu-2204-lts to circleci-server-nomad-image-2404, which stores the image in the us multi-region.

The image has Ubuntu 24.04, Linux kernel linux-gcp 6.8.0-1073. Two regional families have the same image: circleci-server-nomad-image-2404-us-central1 and circleci-server-nomad-image-2404-us-east1.

The client startup script now supports images that already boot with cgroup v1 enabled (required for Docker), and it installs the Docker package that matches the Ubuntu release.

Action: if your organization uses the GCP compute.trustedImageProjects policy, allow projects/circleci-images.

Bug Fixes

• Fixed Docker layer caching (DLC) on machine images that use the containerd image store, such as images with Docker 29. A restored cache marked build steps as CACHED while their image layers were missing, and the job failed with “failed to get reader from content store”. DLC now supports the containerd image store, so restored caches work again.
• Fixed the pipeline values of builds that the v1 and v1.1 APIs trigger with a config override. These builds had pipeline.config_source set to vcs and also had the config repository values. Their OIDC tokens then said that the config came from the repository. Now pipeline.config_source is api and the config repository values are not set, so the OIDC config claims are correct. If your OIDC trust policies use the config claims for these builds, review them.

CVE Fixes

• CVE-2026-116587 in Go JOSE (github.com/go-jose/go-jose/v4) was addressed in authentication-svc, ciam-gateway, lock-job-provider, no-op-job-provider, oidc-service, oidc-tasks-service, permissions-service, picard, policy-service, public-api-service, step services.
• CVE-2026-78661, CVE-2026-97045 in golang.org/x/net was addressed in api-gateway, authentication-svc, ciam-gateway, distributor, lock-job-provider, no-op-job-provider, oidc-service, oidc-tasks-service, permissions-service, picard, policy-service, public-api-service, runner-admin, step services.
• CVE-2026-116591 in compress (github.com/klauspost/compress) was addressed in authentication-svc, distributor, lock-job-provider, permissions-service, picard services.
• CVE-2026-63670, CVE-2026-84371, CVE-2026-113650, CVE-2026-113654, CVE-2026-113661 in sanitize-html was addressed in web-ui service.
• CVE-2023-54404 in Zod (zod) was addressed in web-ui service.
• CVE-2026-67313, CVE-2026-67315, CVE-2026-67319, CVE-2026-67320, CVE-2026-67321 in Axios (axios) was addressed in web-ui-server-admin service.
• CVE-2026-118664 in decode-uri-component was addressed in web-ui-server-admin service.
• CVE-2026-111497 (Node2Shell) in the Brotli library (libbrotli1) was addressed in server-nginx service and in the nomad-gcp Nomad client image.

Configuration Changes

NGINX now runs a CircleCI-maintained NGINX image from the CircleCI registry instead of the upstream nginxinc/nginx-unprivileged:1.30.1 image from Docker Hub. We made this change so that we can patch the NGINX image quickly, for example, for the Node2Shell vulnerability (CVE-2026-111497) in libbrotli1.

The new image is built on nginx/nginx-unprivileged 1.31.8, so NGINX moves from 1.30.1 to 1.31.8.

The nginx.image.repository and nginx.image.tag values are removed. The chart ignores them and builds the NGINX image path from global.container.registry and global.container.org, like other CircleCI images.

Action: If you mirror images for an air-gapped or private-registry install, mirror the server-nginx image too: cciserver.azurecr.io/server-nginx:1.31.6053-5b58edb with the default registry settings. Then remove any nginx.image overrides.

Service changes

New components

server-nginx: the CircleCI-built NGINX image (circleci/server-nginx:1.31.6053-5b58edb), new in images.yaml in this release. It replaces the upstream nginxinc/nginx-unprivileged:1.30.1 image from Docker Hub. NGINX already ran before, so the change is described under Configuration Changes above.

Component Updates

• api-gateway
• api-service
• approval-job-provider-migrator
• audit-log-service
• authentication-svc
• authentication-svc-migrator
• builds-service
• builds-service-migrator
• ciam
• ciam-gateway
• circle-www-api
• contexts-service
• contexts-service-migrator
• distributor
• distributor-migrator
• domain-service
• domain-service-migrator
• insights-service
• insights-service-migrator
• lock-job-provider
• machine-provisioner
• machine-provisioner-migrator
• no-op-job-provider
• oidc-service
• oidc-tasks-service
• oidc-tasks-service-migrator
• orb-service
• orb-service-analytics-migrator
• orb-service-migrator
• permissions-service
• permissions-service-migrator
• picard
• policy-service
• public-api-service
• runner-admin
• runner-admin-migrator
• step
• web-ui
• web-ui-server-admin
• workflows-conductor
• workflows-conductor-migrator

Deprecated components

None.