CVE-2025-53901: wasmtime-wasi Package Vulnerable to Host Panic via fd_renumber Function
Summary
CVE-2025-53901: Wasmtime CLI is vulnerable to host panic through its fd_renumber function. Affects wasmtime-wasi across 3 version ranges.
< 24.0.4
>= 25.0.0, < 33.0.2
>= 34.0.0, < 34.0.2
Fixed in 24.0.4, 33.0.2 or 34.0.2, depending on the release line you run. How to fix ↓
Also tracked for
- rust-wasmtime · Debian:13
- wasmtime · crates.io
The same CVE-2025-53901 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The wasmtime-wasi package is a Rust crate that provides an implementation of the WASIp1 set of import functions for WebAssembly. It allows developers to embed WebAssembly modules in their applications, enabling them to execute WebAssembly code securely. This package is widely used in various applications that require WebAssembly support, making its security critical. The vulnerability in question can lead to a denial-of-service condition, impacting the stability of applications using this package.
Vulnerability Detail
A bug in Wasmtime's implementation of the WASIp1 set of import functions can lead to a WebAssembly guest inducing a panic in the host (embedder). This issue arises when the fd_renumber function is called with either two equal argument values or a second argument that matches a previously-closed file descriptor number. The corrupt state introduced by fd_renumber causes the subsequent path_open call to panic. Although this panic does not lead to memory unsafety or allow WebAssembly to escape its sandbox, it poses a denial-of-service risk for WebAssembly embedders.
How To Fix
Latest published version: 50.0.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 24.0.424.0.4 -
>= 25.0.0, < 33.0.233.0.2 -
>= 34.0.0, < 34.0.234.0.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If you are using components or do not provide guest access to create more file descriptors (e.g., via a preopened filesystem directory), you are not affected by this issue. Otherwise, there are no workarounds available at this time.
Conclusion
The wasmtime-wasi package has a vulnerability (CVE-2025-53901) that can lead to a host panic under specific conditions. Users are advised to update to the patched versions to mitigate this risk. Regular monitoring and updates are essential for maintaining application security.
See every vulnerability recorded for wasmtime-wasi →
FAQ
CVE-2025-53901 is a vulnerability in the wasmtime-wasi package that can cause a host panic when specific functions are called incorrectly.
This vulnerability can lead to a denial-of-service condition, causing your application to crash if the affected functions are invoked improperly.
Versions prior to 24.0.4, between 25.0.0 and 33.0.2, and between 34.0.0 and 34.0.2 are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without any signup.
No, the panic caused by this vulnerability does not introduce memory unsafety or allow WebAssembly to break out of its sandbox.
References
Related vulnerabilities
Recent vulnerabilities recorded for wasmtime-wasi.
