CVE-2021-39216: Use-after-free vulnerability in Wasmtime
Summary
CVE-2021-39216: Wasmtime is an open source runtime for WebAssembly & WASI. Affects wasmtime across 2 version ranges.
< 0.30.0
< 101998733b74624cbd348a2366d05760b40181f3
Fixed in 101998733b74624cbd348a2366d05760b40181f3. How to fix ↓
Also tracked for
The same CVE-2021-39216 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Wasmtime is an open source runtime for WebAssembly & WASI. It provides a platform for executing WebAssembly code and interacting with host environments. Wasmtime supports the use of externrefs, which are references to objects in the host environment that can be passed to and used by WebAssembly code. This vulnerability affects Wasmtime versions 0.19.0 to 0.30.0.
Vulnerability Detail
The vulnerability in Wasmtime is a use-after-free bug that occurs when passing externrefs from the host to guest Wasm content. If multiple externrefs are passed from the host to a Wasm instance at the same time, it can trigger a garbage collection. However, the first externref is not rooted until control is passed to Wasm, which means it can be reclaimed by the garbage collector if there are no other references to it. When control is eventually passed to Wasm, it may attempt to use the first externref, which has already been freed. This vulnerability can lead to crashes or potentially allow an attacker to execute arbitrary code.
How To Fix
Latest published version: 50.0.1 as of 22 Oct 2026
pip install --upgrade "wasmtime==50.0.1"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
101998733b74624cbd348a2366d05760b40181f3
This is the first release that contains the fix.
pip install --upgrade "wasmtime==101998733b74624cbd348a2366d05760b40181f3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
To disable reference types support in Wasmtime, modify the configuration by setting wasm_reference_types to false. Here is an example in Rust:
let mut config = wasmtime::Config::new();
config.wasm_reference_types(false);
Conclusion
The use-after-free vulnerability in Wasmtime can be mitigated by upgrading to version 0.30.0 or by disabling reference types support. It is important to promptly apply the necessary fixes to ensure the security and stability of applications using Wasmtime. For further support and assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for wasmtime →
FAQ
Wasmtime is an open source runtime for WebAssembly & WASI. It allows the execution of WebAssembly code and interaction with host environments.
externref is a reference to an object in the host environment that can be passed to and used by WebAssembly code in Wasmtime.
The vulnerability occurs when multiple externrefs are passed from the host to a Wasm instance at the same time, triggering a garbage collection. If the first externref is not rooted and is reclaimed by the garbage collector, it can lead to a use-after-free bug when control is passed to Wasm.
The vulnerability can result in crashes or potentially allow an attacker to execute arbitrary code.
The vulnerability has been fixed in Wasmtime version 0.30.0. Users should upgrade to this version to mitigate the issue.
References
Related vulnerabilities
Recent vulnerabilities recorded for wasmtime.
