CVE-2025-53901: Wasmtime Host Panic Due to fd_renumber Function Vulnerability
Summary
CVE-2025-53901: Host panic with fd_renumber WASIp1 function. Affects wasmtime across 3 version ranges.
>= 10.0.0, < 24.0.4
>= 25.0.0, < 33.0.2
>= 34.0.0, < 34.0.2
Fixed in 24.0.4, 33.0.2 or 34.0.2, depending on the release line you run. How to fix ↓
Also tracked for
- wasmtime-wasi · crates.io
- rust-wasmtime · Debian:13
The same CVE-2025-53901 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Wasmtime is a standalone JIT-style runtime for WebAssembly, designed to execute WebAssembly modules efficiently and securely. It supports various features, including integration with different programming languages and environments. However, it has been identified to have a vulnerability that can lead to a host panic when using the fd_renumber function, which can disrupt the execution of applications relying on this functionality.
Vulnerability Detail
The vulnerability arises from a flaw in the fd_renumber function within the Wasmtime package. This issue can lead to a host panic, causing the application to crash unexpectedly. The potential ramifications include service downtime and loss of data integrity, particularly for applications that depend heavily on WebAssembly execution. The vulnerability affects versions 10.0.0 to 34.0.2, with specific fixed versions available to mitigate the issue.
How To Fix
Latest published version: 50.0.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 10.0.0, < 24.0.424.0.4 -
>= 25.0.0, < 33.0.233.0.2 -
>= 34.0.0, < 34.0.234.0.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you may avoid using the fd_renumber function in your application until you can update to a patched version. Review your code to identify any calls to this function and consider alternative implementations that do not rely on it.
Conclusion
The CVE-2025-53901 vulnerability in the Wasmtime package poses a risk of host panic due to the fd_renumber function. It is crucial to update to the patched versions to ensure the security and stability of applications using Wasmtime. Utilize tools like Vulert to monitor for vulnerabilities effectively.
See every vulnerability recorded for wasmtime →
FAQ
The CVSS score for this vulnerability is 3.3, indicating a moderate level of severity.
The affected versions are from 10.0.0 to 34.0.2, with specific fixed versions available.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit the Vulert playground at Vulert Scanner to check your application without any signup.
If you cannot update immediately, avoid using the fd_renumber function in your application as a temporary workaround.
More information can be found in the RustSec database and the GitHub security advisory at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-fm79-3f68-h2fc.
References
Related vulnerabilities
Recent vulnerabilities recorded for wasmtime.
