CVE-2026-27195: wasmtime Panic on Dropping [Typed]Func::call_async Future
Summary
CVE-2026-27195: Panic when dropping a [Typed]Func::call_async future. Affects wasmtime across 2 version ranges.
>= 39.0.0, < 40.0.4
>= 41.0.0, < 41.0.4
Fixed in 40.0.4 or 41.0.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Wasmtime is a runtime for executing WebAssembly (Wasm) code, designed to be fast and secure. It allows developers to run Wasm modules in various environments, providing features such as JIT compilation and support for asynchronous operations. However, a recent vulnerability has been identified that can lead to a panic when dropping a specific future related to asynchronous function calls, potentially disrupting applications relying on this functionality.
Vulnerability Detail
The vulnerability arises from a panic occurring when a [Typed]Func::call_async future is dropped. This issue can lead to unexpected application crashes, especially in scenarios where asynchronous operations are heavily utilized. The panic can disrupt the normal flow of the application, causing loss of data or service interruptions. The vulnerability is present in versions 39.0.0 and 41.0.0 of the wasmtime package, and it is crucial for developers to address this issue to maintain application stability.
How To Fix
Latest published version: 50.0.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 39.0.0, < 40.0.440.0.4 -
>= 41.0.0, < 41.0.441.0.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to update to the patched versions as soon as possible to avoid potential issues.
Conclusion
The wasmtime package has a vulnerability that can cause a panic when dropping a [Typed]Func::call_async future. It is essential to update to the patched versions (40.0.4 or 41.0.4) to mitigate the risk of application crashes. Utilizing tools like Vulert can help monitor for such vulnerabilities effectively.
See every vulnerability recorded for wasmtime →
FAQ
The vulnerability causes a panic when dropping a [Typed]Func::call_async future, which can lead to application crashes.
Versions 39.0.0 and 41.0.0 of the wasmtime package are affected by this vulnerability.
You can use Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without any signup.
The CVSS score of this vulnerability is 6.9, indicating a moderate severity level.
While there are no specific workarounds, it is advisable to prioritize updating to the patched versions to ensure application stability.
References
Related vulnerabilities
Recent vulnerabilities recorded for wasmtime.
