Panic in Async-Lifted Function Calls in Wasmtime Package
Summary
RUSTSEC-2026-0353: Panic when invoking an async-lifted function via call. Affects wasmtime across 2 version ranges.
>= 46.0.0, < 48.0.6
>= 49.0.0, < 49.0.3
Fixed in 48.0.6 or 49.0.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Wasmtime is a popular runtime for WebAssembly, allowing developers to run WebAssembly code safely and efficiently. It provides features such as JIT compilation and support for various platforms. However, a recent vulnerability has been identified that can lead to a panic when invoking async-lifted functions via the call method, potentially disrupting applications relying on this functionality.
Vulnerability Detail
The vulnerability arises from a flaw in the handling of async-lifted function calls within the Wasmtime package. When these functions are invoked using the call method, it can lead to unexpected panics, which may crash the application or lead to undefined behavior. This issue affects versions 46.0.0 to 48.0.6 and 49.0.0 to 49.0.3, posing a risk to applications that depend on stable execution of async functions.
How To Fix
Latest published version: 50.0.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 46.0.0, < 48.0.648.0.6 -
>= 49.0.0, < 49.0.349.0.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate updating is not feasible, consider avoiding the use of async-lifted functions with the call method until the package can be updated. This may involve refactoring your code to use synchronous alternatives or handling async calls differently.
Conclusion
The identified vulnerability in the Wasmtime package poses a risk to applications using async-lifted functions. It is crucial to update to the patched versions to ensure stability and security. Users are encouraged to monitor their dependencies and utilize tools like Vulert for real-time vulnerability alerts.
See every vulnerability recorded for wasmtime →
FAQ
The CVSS score for this vulnerability is 5.9, indicating a moderate level of risk.
The affected versions are 46.0.0 to 48.0.6 and 49.0.0 to 49.0.3.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Consider refactoring your code to avoid using async-lifted functions with the call method until you can update to a patched version.
More information can be found in the GitHub security advisory at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m6w2-jwq2-cv2c.
References
Related vulnerabilities
Recent vulnerabilities recorded for wasmtime.
