Wasmtime 50.0.1, 50.0.0 and 49.0.5: Security Fixes and WASIp0 Off

Wasmtime 50.0.1: Five Advisories That Also Affect 50.0.0 #

Wasmtime 50.0.1 is a security-only patch: its five fixes each carry an advisory, and every one of those advisories lists 50.0.0 among the affected versions. Teams that moved to 50.0.0 for its new APIs are therefore exposed until they take this patch. The one with the highest CVSS 3.1 score is GHSA-hmmr-87qq-258j, rated medium with 6.4 in the Wasmtime advisory. The fixed releases are 50.0.1, 49.0.5 and 48.0.8; versions before 48.0.0 are outside its range.

UDP send reaching receive-only addresses #

Only some embedders are exposed. The advisory names those of wasmtime-wasi that offer wasip3 sockets and install a per-address policy with WasiCtxBuilder::socket_addr_check that permits SocketAddrUse::UdpReceive for an address while denying SocketAddrUse::UdpSend for it. The Wasmtime CLI allows or denies all addresses, so it is not affected, and wasip2 sockets are not affected either. An embedder that never splits send and receive permissions has no exposure, but the patch is still the release that carries the other four fixes.

Host memory and HTTP framing in multi-tenant hosts #

GHSA-6fr9-xmw9-5352 (medium, CVSS 4.0 5.9) is a denial of service: when a component receives a borrowed resource that it defined itself, Wasmtime allocated host memory to track the borrow without charging it to the store, so a guest could grow that memory without limit. The advisory lists versions before 36.0.20, from 37.0.0 before 48.0.8, from 49.0.0 before 49.0.5, and 50.0.0 as affected, and 36.0.20, 48.0.8, 49.0.5 and 50.0.1 as patched. GHSA-h4wp-g4x3-7398 (low, CVSS 3.1 3.7) closes the gap left by an earlier content-length fix in the wasip2 HTTP client, which could still send conflicting or wrong content-length headers and expose other servers to request smuggling.

Embedder-only panics and type confusion #

The remaining two need host code to trigger them. GHSA-3982-jqvv-277m makes Wasmtime panic when a TypedFunc uses I31, Option<I31> or Option<NoneRef> and the guest function uses another anyref type. GHSA-qw58-7h65-crq2 lets type information mix across two Engines when StructType::with_finality_and_supertype receives a supertype from another engine; guests cannot trigger it, and the advisory knows of no sandbox escape. Both are rated low and affect 47.0.0 and later.

Wasmtime 50.0.0: WASIp0 Off by Default and New Embedder APIs #

The 50.0.0 release is the feature release behind this patch series, and its changed defaults break existing command lines without a compile step to warn about them. The wasmtime CLI no longer enables WASIp0 (wasi_unstable), as pull request #14479 did as part of a Wasmtime security advisory. Modules that import wasi_unstable now need -Spreview0 on the command line.

wasmtime run -Spreview0 legacy-module.wasm

Winch, CLI options and build requirements #

Winch no longer enables the GC types, exceptions or tail-call proposals by default, because their support in Winch is not yet Tier 1; in the same release Winch gains tail calls on x86_64 and AArch64, so a Winch build that needs tail calls must still enable the proposal. The CLI now rejects zero for the --http-outgoing-body-* options, and wasmtime run now honours them. Building Wasmtime requires Rust 1.97.0, so update the toolchain in CI before bumping the dependency.

API changes embedders must make #

Epoch deadline and call-hook callbacks now receive a StoreHookState instead of a StoreContextMut, which only gives access to the T in a Store<T>, and Accessor::spawn takes an async closure instead of an AccessorTask. Hosts that customise HTTP header filtering have a third change: according to GHSA-jxcf-8qw5-5c33, 50.0.0 replaces WasiHttpHooks::is_forbidden_header with forbidden_header_filter, while 48.0.7 and 49.0.4 add the new method and keep the old one.

The new task-group-hook feature is off by default. Pull request #14416 adds it so embedders can associate guest-to-host calls with the host-to-guest calls they belong to, and removes StoreContextMut::async_call_stack, which it describes as prone to use-after-free of a table slot. Code that called async_call_stack has to move to the hook.

Fixes 50.0.0 already includes #

50.0.0 is outside the affected ranges of the five advisories fixed in 49.0.4 and of the nine 49.0.3 advisories published on 2026-10-14. Its notes list the matching fixes for wasi-http content-length handling, forbidden-header checks on trailers, duplicate content-length headers, large br_table targets on AArch64 and type checks of futures and streams, and the advisories for the HTTP issues name the 50.0.0 release branch among the patched ones. Teams already on 50.0.0 need 50.0.1 for the October 29 advisories only.

Also in this release #

• Compact imports proposal behind Config::wasm_compact_imports, off by default (#14335)
• wasmtime serve: --systemd-listenfd, Unix sockets and --idle-process-timeout
• New Store::gc_heap_grow, ResourceAny::resource_drop_concurrent and Engine::release_idle_pool_memory
• Component-model-async updated to the latest specification, including traps on cancelled tasks and on handles whose other end was dropped
• Fuel now charged for more host allocations made with Val, and saved around call_ref and exception catches
• wasi:filesystem fixes, including stat of symlinks with trailing slashes and directory entry types without d_type
• The full list is in the 50.0.0 release notes

Wasmtime 49.0.5 and the Older Lines: Two Critical Sandbox Escapes #

Wasmtime 49.0.5 lists the same five fixes as 50.0.1 for the 49 line. Teams on 49.x should not stop at an earlier patch: 49.0.3 fixed one batch of advisories on 2026-10-14, and 49.0.4 fixed another five days later, including a critical sandbox escape on aarch64 that every version of the line before 49.0.4 carries.

Cranelift miscompilation on aarch64 and in older lines #

GHSA-mghf-wjfp-p5xm (CVE-2026-115893, critical, CVSS 3.1 9.9) affects any Wasmtime engine on aarch64 with default settings, in all versions since aarch64 support arrived in 2020, before 36.0.19, from 37.0.0 before 48.0.7 and from 49.0.0 before 49.0.4. 48.0.7 and 36.0.19 carry the fix on their lines.

GHSA-897f-g5gm-fmxm (CVE-2026-115889, critical, CVSS 3.1 9.9) is limited to versions before 43: Cranelift bit-packed its SSA value indices, so a very large or crafted function body could overflow them silently in release builds and escape the sandbox on any platform. Wasmtime 43 switched to a full u32 index. The only patched release is 36.0.19, so a host still on 37.0.0 to 42.x has no patch on its own line and must move to a fixed release of a newer one.

HTTP and component-model fixes in 49.0.4 #

49.0.4 also fixes three wasi-http issues: guests could add conflicting content-length headers (GHSA-r8xh-cgf7-392j, low), a wasip3 guest could set a wrong content-length on a spliced response body for response splitting (GHSA-9prg-84vf-g5fc, medium, 5.3), and forwarded trailers skipped the is_forbidden_header hook (GHSA-jxcf-8qw5-5c33, low). GHSA-9pvw-hwfg-92h5 (CVE-2026-115892, medium) is a host panic when an embedder passes a host-created stream or future back into a guest with a different payload type. The release also updates rustls to 0.23.46.

The 49.0.3 batch: panics, a filesystem escape and HTTP requests #

49.0.3 lists fifteen advisories. Nine have their own advisory, rated medium; most concern the component model and lead to host panics: GHSA-93g3-36p8-x2gc, GHSA-3r89-v5mq-j5xf, GHSA-7v24-42x9-pxf7, GHSA-5hhx-4wrr-3j9g, GHSA-m6w2-jwq2-cv2c, GHSA-hmwq-g22x-qjw5, GHSA-63h4-6cx9-pjfj and GHSA-vcg5-q8m5-8379, and one is a stack overflow dropping long chains of recursive types (GHSA-wjc8-633q-pwxr). The notes also list a filesystem sandbox escape when renaming symlinks with trailing slashes (GHSA-m9f7-9w4p-gv38), guests sending absolute-form HTTP requests to other hosts (GHSA-5qpp-g3j2-8frx), a crash on a long URL before the query (GHSA-w36r-2hch-9xp9), handle tables charged to no limit (GHSA-q554-3cjc-rx7p), unaligned host data from exception tags (GHSA-p79w-pv2r-29qp) and a transcode panic in fused adapters (GHSA-54p9-vhhq-8f7q). 48.0.6 lists the same fixes except the last one.

Which Wasmtime Release Fixes Each Advisory #

Upgrade Checklist for Wasmtime Hosts #

1. Before upgrading to the 50 line, update the Rust toolchain to 1.97.0 and find modules that import wasi_unstable; add -Spreview0 to the wasmtime commands that run them.
2. In embedding code, rewrite epoch deadline and call-hook callbacks for StoreHookState, replace AccessorTask arguments to Accessor::spawn with async closures, move a custom is_forbidden_header to forbidden_header_filter, and replace any use of async_call_stack.
3. Move wasmtime, wasmtime-wasi and wasmtime-wasi-http to 50.0.1; on an older line use 49.0.5, 48.0.8 or 36.0.20, and leave 37.0.0 to 42.x for a fixed line.
4. If you compile with Winch, enable the GC types, exceptions or tail-call proposals your modules use, since 50.0.0 no longer turns them on.
5. After the upgrade, check any socket_addr_check policy that allows UdpReceive but not UdpSend, and remove zero values from --http-outgoing-body-* options in scripts.