CVE-2026-34942: Wasmtime Panic Due to Misaligned UTF-16 String Transcoding
Summary
CVE-2026-34942: Panic when transcoding misaligned component model UTF-16 strings. Affects wasmtime across 4 version ranges.
>= 0.0.0-0, < 24.0.7
>= 25.0.0, < 36.0.7
>= 37.0.0, < 42.0.2
>= 43.0.0, < 43.0.1
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Wasmtime is a high-performance runtime for WebAssembly, designed to execute WebAssembly modules safely and efficiently. It supports various features such as JIT compilation and AOT compilation, making it suitable for both server-side and client-side applications. However, a recent vulnerability has been identified that affects its ability to handle misaligned UTF-16 strings, potentially leading to application crashes.
Vulnerability Detail
The vulnerability arises from a panic condition triggered when transcoding misaligned component model UTF-16 strings. This issue can lead to unexpected application behavior, including crashes, which may disrupt service availability and compromise user experience. The vulnerability is particularly concerning in applications that rely on WebAssembly for critical functionality, as it could be exploited to cause denial of service.
How To Fix
Latest published version: 50.0.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 0.0.0-0, < 24.0.724.0.7 -
>= 25.0.0, < 36.0.736.0.7 -
>= 37.0.0, < 42.0.242.0.2 -
>= 43.0.0, < 43.0.143.0.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. It is recommended to update to the patched versions as soon as possible to mitigate the risk.
Conclusion
The CVE-2026-34942 vulnerability in Wasmtime poses a significant risk due to its potential to cause application crashes when handling misaligned UTF-16 strings. It is crucial for developers to update to the patched versions to ensure the stability and security of their applications.
See every vulnerability recorded for wasmtime →
FAQ
CVE-2026-34942 is a vulnerability in the Wasmtime package that causes a panic when transcoding misaligned UTF-16 strings.
Exploiting this vulnerability can lead to application crashes, resulting in denial of service and potential disruption of services.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The patched versions of Wasmtime are 24.0.7, 36.0.7, 42.0.2, and 43.0.1.
Vulert is a tool that monitors and alerts in real-time for open-source vulnerabilities in software using just Cargo.lock, without requiring access to the code or installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for wasmtime.
