aws-dk-lib/aws-rds/lib/cluster-engine.d.ts: Aurora supports newer than 15.15 postgresq, when version flags updates

[kuosman]

Describe the issue

PostgreSQL has vulnerability CVE-2026-2004 and to my understanding aurora supporta already newer than affected version. When version flag unpated next time ?

I used this my code below way:

const dbCluster = new DatabaseCluster(this, 'dbcluster', {
    engine: DatabaseClusterEngine.auroraPostgres({
        version: AuroraPostgresEngineVersion.VER_15_14,
    }),
    ...
});

I need update least 15.16

Links

https://nvd.nist.gov/vuln/detail/CVE-2026-2004

https://docs.aws.amazon.com/AmazonRDS/latest/PostgreSQLReleaseNotes/postgresql-versions.html#postgresql-versions-version1517

[pahud]

Hi @kuosman,

This is a good catch — thanks for flagging it. It appears the AuroraPostgresEngineVersion class is currently missing constants for PostgreSQL 15.16 and 15.17, even though AWS Aurora already supports them.

Problem at a Glance:

┌──────────────────────┐      ┌───────────────────────────────┐
│  Your CDK Code       │─────▶│  AuroraPostgresEngineVersion  │
│  needs VER_15_16+    │      │  max: VER_15_15               │
└──────────────────────┘      └──────────────┬────────────────┘
                                             │
                                             ▼
                                   ┌───────────────────┐
                                   │  ❌ VER_15_16 and  │
                                   │  VER_15_17 missing │
                                   └───────────────────┘

The version constants in AuroraPostgresEngineVersion are manually maintained, so they need a PR to add new entries when AWS releases new Aurora PostgreSQL versions.

Immediate workaround: You can use the of() factory method to specify any version right now without waiting for a CDK release:

const dbCluster = new DatabaseCluster(this, 'dbcluster', {
    engine: DatabaseClusterEngine.auroraPostgres({
        version: AuroraPostgresEngineVersion.of('15.16', '15', {
            s3Import: true,
            s3Export: true,
        }),
    }),
});

This should unblock you while the version constants get added.

[pahud]

Hi

I investigated and wanted to share some findings:

The AuroraPostgresEngineVersion class in aws-cdk-lib/aws-rds currently includes all Aurora PostgreSQL versions that AWS has released. As of today, the highest versions are:

• PG 17: 17.7
• PG 16: 16.11
• PG 15: 15.15
• PG 14: 14.20
• PG 13: 13.23

These match both the Aurora PostgreSQL Release Notes and the aws rds describe-db-engine-versions --engine aurora-postgresql API output.

The versions needed for CVE-2026-2004 (e.g., 15.16, 16.12, 17.8) are available for RDS for PostgreSQL (see RDS PostgreSQL Release Notes) but have not yet been released for Aurora PostgreSQL. Aurora typically receives new minor versions on a separate, later schedule than RDS PostgreSQL.

Once AWS releases these versions for Aurora, a PR can be submitted to add them. I'll keep an eye on this and follow up when they become available.

[rgoltz]

Hi @kuosman & @pahud, I went ahead and addressed this version-update in PR #37488 which adds the following missing Aurora PostgreSQL versions:

• VER_15_17 (15.17)
• VER_16_13 (16.13)
• VER_17_9 (17.9)
• VER_14_22 (14.22)

Note: 15.16 is not available for Aurora PostgreSQL — the next available version after 15.15 is 15.17, which should includes the fix for CVE-2026-2004.