CVE-2026-27572: Wasmtime Package Panic Due to Excessive Fields in wasi:http/types.fields
Summary
CVE-2026-27572: Panic adding excessive fields to a wasi:http/types.fields instance. Affects wasmtime across 4 version ranges.
>= 0.0.0-0, < 24.0.6
>= 25.0.0, < 36.0.6
>= 37.0.0, < 40.0.4
>= 41.0.0, < 41.0.4
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Wasmtime is a popular runtime for WebAssembly that allows developers to run WebAssembly modules in various environments. It provides a secure and efficient way to execute WebAssembly code, making it a valuable tool for developers working with WebAssembly applications. However, like any software, it can have vulnerabilities that may affect its stability and security. This specific vulnerability arises from the handling of excessive fields in a wasi:http/types.fields instance, which can lead to a panic during execution.
Vulnerability Detail
The vulnerability identified as CVE-2026-27572 is a panic that occurs when excessive fields are added to a wasi:http/types.fields instance in the Wasmtime package. This issue can lead to application crashes and unexpected behavior, potentially compromising the stability of applications relying on Wasmtime for WebAssembly execution. The vulnerability is classified with a CVSS score of 6.9, indicating a moderate severity level. It is crucial for developers using Wasmtime to be aware of this issue and take appropriate action to mitigate its impact.
How To Fix
Latest published version: 50.0.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 0.0.0-0, < 24.0.624.0.6 -
>= 25.0.0, < 36.0.636.0.6 -
>= 37.0.0, < 40.0.440.0.4 -
>= 41.0.0, < 41.0.441.0.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, developers can limit the number of fields added to the wasi:http/types.fields instance to avoid triggering the panic. This may involve implementing validation checks before adding fields to ensure that the count remains within acceptable limits.
Conclusion
In summary, CVE-2026-27572 is a significant vulnerability in the Wasmtime package that can lead to application panics due to excessive fields in a wasi:http/types.fields instance. Developers are advised to update to the patched versions to mitigate this issue and ensure the stability of their applications.
See every vulnerability recorded for wasmtime →
FAQ
CVE-2026-27572 is a vulnerability in the Wasmtime package that causes a panic when excessive fields are added to a wasi:http/types.fields instance.
The vulnerability can lead to application crashes and unexpected behavior, affecting the stability of applications that utilize Wasmtime.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The patched versions of Wasmtime are 24.0.6, 36.0.6, 40.0.4, and 41.0.4.
The CVSS score of this vulnerability is 6.9, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for wasmtime.
