Security Advisory: Absolute-Form HTTP Requests Vulnerability in wasmtime-wasi-http
Summary
RUSTSEC-2026-0350: Guests can send absolute-form HTTP requests to different hosts. Affects wasmtime-wasi-http across 3 version ranges.
>= 0.0.0-0, < 36.0.18
>= 37.0.0, < 48.0.6
>= 49.0.0, < 49.0.3
Fixed in 36.0.18, 48.0.6 or 49.0.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
wasmtime-wasi-http is a Rust package that provides HTTP capabilities for WebAssembly applications. It allows developers to build applications that can make HTTP requests, enabling interaction with web services. The package is designed to be lightweight and efficient, making it suitable for use in various environments, including serverless applications and edge computing. However, it has been found to be vulnerable to a security issue that allows guests to send absolute-form HTTP requests to different hosts, potentially leading to unauthorized access or data leakage.
Vulnerability Detail
The vulnerability arises from the handling of absolute-form HTTP requests, which can be exploited by malicious users to send requests to unintended hosts. This can lead to various security issues, including data exfiltration and unauthorized access to sensitive information. The vulnerability is categorized under CVSS version 4.0 with a score of 4.0, indicating a moderate severity level. It affects multiple versions of the wasmtime-wasi-http package, specifically versions prior to 36.0.18, 37.0.0, and 49.0.0, which have been patched in subsequent releases.
How To Fix
Latest published version: 50.0.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 0.0.0-0, < 36.0.1836.0.18 -
>= 37.0.0, < 48.0.648.0.6 -
>= 49.0.0, < 49.0.349.0.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can restrict the hosts that the application can send requests to by implementing a whitelist of allowed domains. This can be done by modifying the request handling logic to check the target host against a predefined list before proceeding with the request.
Conclusion
The wasmtime-wasi-http package has a vulnerability that allows for absolute-form HTTP requests to different hosts, posing a risk of unauthorized access and data leakage. It is crucial to update to the patched versions to mitigate this risk. Additionally, implementing a temporary workaround can help secure applications until an update can be performed.
See every vulnerability recorded for wasmtime-wasi-http →
FAQ
The vulnerability allows guests to send absolute-form HTTP requests to different hosts, which can lead to unauthorized access and data leakage.
Affected versions include those prior to 36.0.18, 37.0.0, and 49.0.0. Ensure to update to the latest patched versions.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without any signup.
Implement a temporary workaround by restricting the hosts that your application can send requests to, using a whitelist approach.
The CVSS score of this vulnerability is 4.0, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for wasmtime-wasi-http.
