Panic Risk in Wasmtime Package: Vulnerability When Running Pending Calls After a Trap
Summary
RUSTSEC-2026-0361: Panic when pending calls are run after a trap. Affects wasmtime across 2 version ranges.
>= 46.0.0, < 48.0.6
>= 49.0.0, < 49.0.3
Fixed in 48.0.6 or 49.0.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Wasmtime is a standalone JIT-style runtime for WebAssembly, designed to execute WebAssembly code safely and efficiently. It provides a high-performance environment for running WebAssembly modules, making it a popular choice for developers looking to integrate WebAssembly into their applications. However, a recent vulnerability has been identified that can lead to a panic when pending calls are executed after a trap, potentially affecting the stability of applications using this package.
Vulnerability Detail
The vulnerability arises from a flaw in the Wasmtime runtime where pending calls may trigger a panic if they are executed after a trap has occurred. This issue can lead to unexpected application behavior, crashes, or even data loss, especially in production environments where stability is critical. The vulnerability affects versions 46.0.0 to 48.0.6 and 49.0.0 to 49.0.3 of the Wasmtime package, as detailed in the RustSec advisory.
How To Fix
Latest published version: 50.0.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 46.0.0, < 48.0.648.0.6 -
>= 49.0.0, < 49.0.349.0.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate updating is not feasible, consider implementing error handling around the calls that may lead to a panic. This can be done by wrapping the calls in a try-catch block to gracefully handle any potential errors.
Conclusion
In summary, the Wasmtime package has a vulnerability that can lead to a panic when pending calls are executed after a trap. It is crucial for developers using this package to update to the latest patched version to ensure application stability and security. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for wasmtime →
FAQ
The CVSS score of this vulnerability is 5.9, indicating a moderate severity level.
Versions 46.0.0 to 48.0.6 and 49.0.0 to 49.0.3 of Wasmtime are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Implement error handling around the calls that may lead to a panic as a temporary workaround until you can update.
More information can be found in the RustSec advisory at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hmwq-g22x-qjw5.
References
Related vulnerabilities
Recent vulnerabilities recorded for wasmtime.
