VulertSecurity VulertSecurity

Vulnerability Database · crates.io · Package report

wasmtime: vulnerability history, versions and safety

wasmtime is a package in the crates.io ecosystem. Vulert records 106 vulnerabilities for it across 108 releases, from Sep 2021 to Oct 2026. Each vulnerability names the versions it affects, the fixed version to move to, and a workaround where no fix has been published.

i
106 vulnerabilities recorded C3 H2 M21 L13 U67
i
0 with no fix published

Every vulnerability has a patched version to move to.

i
62 in the last 12 months

Most recent disclosure 19 Oct 2026.

See the disclosure history →
i
0 malicious-package vulnerabilities

No published version shipped hostile code.

See all wasmtime vulnerabilities

Vulert verdict on wasmtime 50.0.0 i

Updated on 23 Oct 2026

Good news: 50.0.0, the version you would install today, has no known vulnerabilities. Older releases do — the table below lists all 106.

Package health score 55/100
  • Security Unfixed issues
  • Maintenance Sustainable
  • Popularity Niche
  • Community Moderate

What to do: Stay on 50.0.0 or newer. This can change: a vulnerability disclosed tomorrow can affect 50.0.0 too — Vulert watches the package and alerts you if that happens. Monitor it with Vulert →

  • Current release 50.0.0 — unaffected i
  • Vulnerabilities on record 106 over 5 years · 62 in the last year i
  • Latest disclosure 19 Oct 2026 i
  • Highest CVSS 9.9 i
  • With no published fix 0 i
  • Stars 18,741 i
  • OpenSSF scorecard 6/10 i
  • Last release this month i
  • Licence Apache-2.0 WITH LLVM-exception i

Version list, release dates, licence and dependants published by crates.io, refreshed 22 Oct 2026. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Versions

Which versions are affected

Every version Vulert tracks for wasmtime, newest first, with the vulnerabilities recorded against each one. A version showing none has no vulnerability in the Vulert database — open it for the full picture on that release.

i
Version Released Vulert vulnerabilities Licence Fix published Details
50.0.0 20 Oct 2026 none Apache-2.0 WITH LLVM-exception — Details →
48.0.7 19 Oct 2026 none Apache-2.0 WITH LLVM-exception — Details →
49.0.4 19 Oct 2026 none Apache-2.0 WITH LLVM-exception — Details →
36.0.19 19 Oct 2026 none Apache-2.0 WITH LLVM-exception — Details →
49.0.3 14 Oct 2026 none Apache-2.0 WITH LLVM-exception — Details →
48.0.6 14 Oct 2026 U1 Apache-2.0 WITH LLVM-exception Yes Details →
36.0.18 14 Oct 2026 U2 Apache-2.0 WITH LLVM-exception Yes Details →
50.0.0-rc.1 05 Oct 2026 none Apache-2.0 WITH LLVM-exception — Details →
48.0.5 02 Oct 2026 U11 Apache-2.0 WITH LLVM-exception Yes Details →
48.0.4 02 Oct 2026 U11 Apache-2.0 WITH LLVM-exception Yes Details →
49.0.2 02 Oct 2026 U1 Apache-2.0 WITH LLVM-exception Yes Details →
36.0.17 02 Oct 2026 U3 Apache-2.0 WITH LLVM-exception Yes Details →
49.0.1 24 Sep 2026 U1 Apache-2.0 WITH LLVM-exception Yes Details →
36.0.16 24 Sep 2026 U3 Apache-2.0 WITH LLVM-exception Yes Details →
48.0.3 24 Sep 2026 U14 Apache-2.0 WITH LLVM-exception Yes Details →
49.0.0 21 Sep 2026 U1 Apache-2.0 WITH LLVM-exception Yes Details →
48.0.2 10 Sep 2026 U15 Apache-2.0 WITH LLVM-exception Yes Details →
36.0.15 10 Sep 2026 U4 Apache-2.0 WITH LLVM-exception Yes Details →
49.0.0-rc.1 05 Sep 2026 none Apache-2.0 WITH LLVM-exception — Details →
48.0.1 24 Aug 2026 U15 Apache-2.0 WITH LLVM-exception Yes Details →
36.0.14 20 Aug 2026 U4 Apache-2.0 WITH LLVM-exception Yes Details →
46.0.3 20 Aug 2026 U11 Apache-2.0 WITH LLVM-exception Yes Details →
47.0.4 20 Aug 2026 U15 Apache-2.0 WITH LLVM-exception Yes Details →
24.0.13 20 Aug 2026 U10 Apache-2.0 WITH LLVM-exception Yes Details →
48.0.0 20 Aug 2026 U15 Apache-2.0 WITH LLVM-exception Yes Details →
47.0.3 31 Jul 2026 U15 Apache-2.0 WITH LLVM-exception Yes Details →
46.0.2 31 Jul 2026 U12 Apache-2.0 WITH LLVM-exception Yes Details →
36.0.13 31 Jul 2026 U4 Apache-2.0 WITH LLVM-exception Yes Details →
24.0.12 31 Jul 2026 U11 Apache-2.0 WITH LLVM-exception Yes Details →
47.0.2 21 Jul 2026 U15 Apache-2.0 WITH LLVM-exception Yes Details →
47.0.1 20 Jul 2026 U15 Apache-2.0 WITH LLVM-exception Yes Details →
47.0.0 20 Jul 2026 U15 Apache-2.0 WITH LLVM-exception Yes Details →
36.0.12 24 Jun 2026 U4 Apache-2.0 WITH LLVM-exception Yes Details →
45.0.3 24 Jun 2026 U3 Apache-2.0 WITH LLVM-exception Yes Details →
46.0.1 24 Jun 2026 L1 U13 Apache-2.0 WITH LLVM-exception Yes Details →
24.0.11 24 Jun 2026 U12 Apache-2.0 WITH LLVM-exception Yes Details →
46.0.0 22 Jun 2026 L1 U13 Apache-2.0 WITH LLVM-exception Yes Details →
24.0.10 15 Jun 2026 U12 Apache-2.0 WITH LLVM-exception Yes Details →
44.0.3 15 Jun 2026 U3 Apache-2.0 WITH LLVM-exception Yes Details →
45.0.2 15 Jun 2026 U3 Apache-2.0 WITH LLVM-exception Yes Details →
36.0.11 15 Jun 2026 U4 Apache-2.0 WITH LLVM-exception Yes Details →
45.0.1 05 Jun 2026 U3 Apache-2.0 WITH LLVM-exception Yes Details →
44.0.2 21 May 2026 U3 Apache-2.0 WITH LLVM-exception Yes Details →
36.0.10 21 May 2026 U4 Apache-2.0 WITH LLVM-exception Yes Details →
45.0.0 21 May 2026 U3 Apache-2.0 WITH LLVM-exception Yes Details →
24.0.9 21 May 2026 U12 Apache-2.0 WITH LLVM-exception Yes Details →
36.0.9 05 May 2026 U4 Apache-2.0 WITH LLVM-exception Yes Details →
36.0.8 30 Apr 2026 U4 Apache-2.0 WITH LLVM-exception Yes Details →
43.0.2 30 Apr 2026 U3 Apache-2.0 WITH LLVM-exception Yes Details →
44.0.1 30 Apr 2026 U3 Apache-2.0 WITH LLVM-exception Yes Details →
24.0.8 30 Apr 2026 U12 Apache-2.0 WITH LLVM-exception Yes Details →
44.0.0 20 Apr 2026 U3 Apache-2.0 WITH LLVM-exception Yes Details →
42.0.2 09 Apr 2026 U3 Apache-2.0 WITH LLVM-exception Yes Details →
43.0.1 09 Apr 2026 U3 Apache-2.0 WITH LLVM-exception Yes Details →
36.0.7 09 Apr 2026 M1 U5 Apache-2.0 WITH LLVM-exception Yes Details →
24.0.7 09 Apr 2026 U12 Apache-2.0 WITH LLVM-exception Yes Details →
43.0.0 20 Mar 2026 L1 Apache-2.0 WITH LLVM-exception Yes Details →
42.0.1 25 Feb 2026 U3 Apache-2.0 WITH LLVM-exception Yes Details →
41.0.4 24 Feb 2026 U1 Apache-2.0 WITH LLVM-exception Yes Details →
40.0.4 24 Feb 2026 U1 Apache-2.0 WITH LLVM-exception Yes Details →
42.0.0 24 Feb 2026 U3 Apache-2.0 WITH LLVM-exception Yes Details →
24.0.6 24 Feb 2026 M5 U17 Apache-2.0 WITH LLVM-exception Yes Details →
36.0.6 24 Feb 2026 C2 M3 L2 U11 Apache-2.0 WITH LLVM-exception Yes Details →
41.0.3 04 Feb 2026 U1 Apache-2.0 WITH LLVM-exception Yes Details →
41.0.2 03 Feb 2026 U1 Apache-2.0 WITH LLVM-exception Yes Details →
40.0.3 27 Jan 2026 M1 U2 Apache-2.0 WITH LLVM-exception Yes Details →
41.0.1 27 Jan 2026 U1 Apache-2.0 WITH LLVM-exception Yes Details →
36.0.5 26 Jan 2026 C2 M3 L2 U11 Apache-2.0 WITH LLVM-exception Yes Details →
41.0.0 20 Jan 2026 U1 Apache-2.0 WITH LLVM-exception Yes Details →
36.0.4 14 Jan 2026 C2 M4 L2 U12 Apache-2.0 WITH LLVM-exception Yes Details →
40.0.2 14 Jan 2026 M1 U2 Apache-2.0 WITH LLVM-exception Yes Details →
39.0.2 14 Jan 2026 M1 U2 Apache-2.0 WITH LLVM-exception Yes Details →
40.0.1 07 Jan 2026 M1 U2 Apache-2.0 WITH LLVM-exception Yes Details →
40.0.0 22 Dec 2025 M1 U2 Apache-2.0 WITH LLVM-exception Yes Details →
39.0.1 24 Nov 2025 M1 U2 Apache-2.0 WITH LLVM-exception Yes Details →
39.0.0 20 Nov 2025 M1 U2 Apache-2.0 WITH LLVM-exception Yes Details →
38.0.4 11 Nov 2025 none Apache-2.0 WITH LLVM-exception — Details →
37.0.3 11 Nov 2025 none Apache-2.0 WITH LLVM-exception — Details →
36.0.3 11 Nov 2025 C2 M4 L2 U12 Apache-2.0 WITH LLVM-exception Yes Details →
24.0.5 11 Nov 2025 M7 U19 Apache-2.0 WITH LLVM-exception Yes Details →
38.0.3 24 Oct 2025 L1 Apache-2.0 WITH LLVM-exception Yes Details →
38.0.2 21 Oct 2025 L2 U1 Apache-2.0 WITH LLVM-exception Yes Details →
38.0.1 20 Oct 2025 L2 U1 Apache-2.0 WITH LLVM-exception Yes Details →
38.0.0 20 Oct 2025 L2 U1 Apache-2.0 WITH LLVM-exception Yes Details →
37.0.2 07 Oct 2025 none Apache-2.0 WITH LLVM-exception — Details →
37.0.1 23 Sep 2025 none Apache-2.0 WITH LLVM-exception — Details →
37.0.0 20 Sep 2025 none Apache-2.0 WITH LLVM-exception — Details →
36.0.2 26 Aug 2025 C2 M4 L2 U12 Apache-2.0 WITH LLVM-exception Yes Details →
36.0.1 21 Aug 2025 C2 M4 L2 U12 Apache-2.0 WITH LLVM-exception Yes Details →
36.0.0 20 Aug 2025 C2 M4 L2 U12 Apache-2.0 WITH LLVM-exception Yes Details →
35.0.0 22 Jul 2025 C2 M4 L2 U12 Apache-2.0 WITH LLVM-exception Yes Details →
33.0.2 18 Jul 2025 C2 M4 L2 U12 Apache-2.0 WITH LLVM-exception Yes Details →
34.0.2 18 Jul 2025 C2 M4 L2 U12 Apache-2.0 WITH LLVM-exception Yes Details →
24.0.4 18 Jul 2025 M7 U20 Apache-2.0 WITH LLVM-exception Yes Details →
34.0.1 24 Jun 2025 C2 M4 L2 U12 Apache-2.0 WITH LLVM-exception Yes Details →
33.0.1 24 Jun 2025 C2 M4 L2 U12 Apache-2.0 WITH LLVM-exception Yes Details →
24.0.3 24 Jun 2025 M7 U21 Apache-2.0 WITH LLVM-exception Yes Details →
32.0.1 24 Jun 2025 C2 M4 L2 U12 Apache-2.0 WITH LLVM-exception Yes Details →
34.0.0 20 Jun 2025 C2 M4 L2 U12 Apache-2.0 WITH LLVM-exception Yes Details →
33.0.0 20 May 2025 C2 M4 L2 U12 Apache-2.0 WITH LLVM-exception Yes Details →
32.0.0 21 Apr 2025 C2 M4 L2 U12 — Yes Details →
31.0.0 20 Mar 2025 C1 M4 L2 U12 — Yes Details →
30.0.2 25 Feb 2025 C1 M4 L2 U12 — Yes Details →
30.0.1 21 Feb 2025 C1 M4 L2 U12 — Yes Details →
30.0.0 20 Feb 2025 C1 M4 L2 U12 — Yes Details →
29.0.1 21 Jan 2025 C1 M3 L2 U11 — Yes Details →
29.0.0 20 Jan 2025 C1 M3 L2 U11 — Yes Details →
28.0.1 14 Jan 2025 C1 M2 L2 U10 — Yes Details →
28.0.0 20 Dec 2024 C1 M2 L2 U10 — Yes Details →
27.0.0 20 Nov 2024 C1 M2 L1 U10 — Yes Details →
25.0.3 05 Nov 2024 C1 M2 L1 U10 — Yes Details →
26.0.1 05 Nov 2024 C1 M2 L1 U10 — Yes Details →
24.0.2 05 Nov 2024 M7 U21 — Yes Details →
26.0.0 22 Oct 2024 C1 M2 L1 U10 — Yes Details →
23.0.3 09 Oct 2024 M7 L1 U22 — Yes Details →
22.0.1 09 Oct 2024 M7 L1 U22 — Yes Details →
21.0.2 09 Oct 2024 M7 L1 U22 — Yes Details →
24.0.1 09 Oct 2024 M7 L1 U22 — Yes Details →
25.0.2 09 Oct 2024 C1 M2 L1 U10 — Yes Details →
25.0.1 24 Sep 2024 C1 M2 L1 U10 — Yes Details →

The newest 120 of 234 versions Vulert tracks. Severity counts are the vulnerabilities recorded against that exact release.

02 Disclosure history

How often vulnerabilities are recorded

  • 2021 4
  • 2022 21
  • 2023 8
  • 2024 9
  • 2025 5
  • 2026 59

Counted by the year Vulert recorded each vulnerability — the same date the table below shows as disclosed. 62 of the 106 were recorded in the last 12 months.

03 Vulnerabilities

Recorded vulnerabilities for wasmtime

The 5 most severe of 106 vulnerabilities recorded for this package

Search all 106 in the database →
Vulnerability Severity Fixed version ↑ Disclosed ↑
Critical Bit-Packing Overflow in Wasmtime Compiler 9.9 critical 36.0.19 19 Oct 2026
Critical Vulnerability in Wasmtime: Incorrect Jump Target on Large Wasm br_table Instruction 9.9 critical 36.0.19 19 Oct 2026
CVE-2023-26489: wasmtime Out-of-Bounds Read/Write Vulnerability 9.9 critical 4.0.1 09 Mar 2023
CVE-2023-26489: Wasmtime Guest-Controlled Out-of-Bounds Read/Write Vulnerability 9.9 critical 4.0.1 02 Mar 2023
Buffer Overflow Vulnerability in Wasmtime Package: Async-Lifted Callback Result Count Unvalidated 9.3 critical 48.0.4 02 Oct 2026

Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback

Updated: 23/Oct/2026 · Vulnerabilities in our DB: 524315

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About wasmtime

Is wasmtime safe to use?

Vulert records 106 vulnerabilities for wasmtime in crates.io: 3 critical, 2 high, 21 medium and 13 low, plus 67 not yet rated. Every one of them has a published fix, so the practical answer is to run a supported release and keep it patched.

What is wasmtime's Vulert package health score?

Vulert scores wasmtime 55/100, which reads as usable, but worth attention. The score weighs the vulnerability record (40), maintenance and release cadence (25), adoption from dependents and stars (20) and community signals such as the OpenSSF scorecard and forks (15).

Is the latest version of wasmtime affected?

No. 50.0.0, the version you would install today, has no vulnerabilities on record against it. Earlier releases do — the version table above lists each release with what affects it.

How many vulnerabilities does wasmtime have?

106 vulnerabilities are recorded for wasmtime in the crates.io ecosystem: 3 critical, 2 high, 21 medium and 13 low, plus 67 not yet rated. The ledger on this page lists the same counts next to the date of the most recent disclosure.

How often are new wasmtime vulnerabilities disclosed?

62 vulnerabilities were recorded for wasmtime in the last 12 months, and the oldest entry in this database dates to 17 Sep 2021. Recency matters more than a lifetime total: it shows how actively new issues are being disclosed for the package you are considering.

Which versions of wasmtime are affected?

Each vulnerability on this page lists the affected version range and the fixed version to move to. Open the vulnerability for the version you actually run — fixes are specific to a release line, not to the package as a whole.

How do I monitor wasmtime for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the wasmtime version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.