CVE-2021-39219: Type Confusion Vulnerability in wasmtime
Summary
CVE-2021-39216: Wrong type for Linker-define functions when used across two Engines. Affects wasmtime versions < 0.30.0. Fixed in 0.30.0. How to fix ↓
Also tracked for
The same CVE-2021-39216 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
wasmtime is a Rust library that provides a runtime for executing WebAssembly modules. It allows developers to embed WebAssembly in their applications and provides a safe API for interacting with WebAssembly code. The library includes features such as a linker for connecting WebAssembly modules with host functions and a store for managing WebAssembly instances. However, a type confusion vulnerability has been discovered in the Linker component of wasmtime.
Vulnerability Detail
The type confusion vulnerability in wasmtime arises when the Linker is used across two different Engine instances. Normally, the Linker ensures memory safety by marking functions as either safe or unsafe. However, when one Engine is used to create the Linker and then a different Engine is used to create a Store, type confusion can occur. This can result in the ability to safely call a function with the wrong type, leading to potential memory unsafety issues. Although the impact of this vulnerability is relatively small, as usage of multiple Engine instances is rare, it is still a serious concern for applications utilizing multiple Engine instances with a Linker.
How To Fix
Latest published version: 50.0.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.30.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the patched version is not possible, a workaround is to use only one Engine for the entire program, as intended by the design of wasmtime. Alternatively, if multiple Engine instances are required, ensure that the Linker is only used with one Engine to avoid the type confusion vulnerability.
Conclusion
The type confusion vulnerability in wasmtime can lead to potential memory unsafety issues when using multiple Engine instances with a Linker. It is recommended to upgrade to version 0.30.0 of wasmtime to fix the vulnerability. If upgrading is not possible, follow the provided workarounds to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for wasmtime →
FAQ
wasmtime is a Rust library that provides a runtime for executing WebAssembly modules. It allows developers to embed WebAssembly in their applications and provides a safe API for interacting with WebAssembly code.
The impact of this vulnerability is relatively small, as usage of multiple Engine instances in an embedding is rare. However, if the vulnerability is triggered, it can result in type confusion of function pointers and potential memory unsafety issues.
To fix this vulnerability, upgrade to version 0.30.0 of wasmtime. Update the wasmtime dependency in your project's Cargo.toml file to version 0.30.0 or later.
Yes, if upgrading to the patched version is not possible, you can use only one Engine for the entire program or ensure that the Linker is only used with one Engine to avoid the type confusion vulnerability.
For more information, you can refer to the advisory on the GitHub repository of wasmtime: https://github.com/bytecodealliance/wasmtime
References
Related vulnerabilities
Recent vulnerabilities recorded for wasmtime.
