Wasmtime wasi:http Package Vulnerability: Panic on Zero Timeout
Summary
RUSTSEC-2026-0320: Wasmtime wasi:http implementation panics with a zero timeout supplied. Affects wasmtime-wasi-http across 2 version ranges.
>= 46.0.0, < 48.0.4
>= 49.0.0, < 49.0.2
Fixed in 48.0.4 or 49.0.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The wasmtime-wasi-http package is part of the Wasmtime project, which provides a runtime for WebAssembly applications. This package specifically implements the WASI (WebAssembly System Interface) HTTP functionality, allowing WebAssembly modules to make HTTP requests. It is designed to be efficient and secure, but like any software, it can have vulnerabilities that may affect its stability and security.
Vulnerability Detail
The vulnerability arises from the implementation of the wasi:http functionality in the wasmtime-wasi-http package, where supplying a zero timeout leads to a panic in the application. This issue can disrupt the normal operation of applications relying on this package, potentially leading to crashes or unexpected behavior. The vulnerability was identified in versions 46.0.0 and 49.0.0, and it is crucial for developers to address this issue to maintain application stability and security.
How To Fix
Latest published version: 50.0.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 46.0.0, < 48.0.448.0.4 -
>= 49.0.0, < 49.0.249.0.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, avoid using a zero timeout when making HTTP requests with the wasmtime-wasi-http package. Ensure that the timeout value is set to a positive integer to prevent the panic from occurring.
Conclusion
The wasmtime-wasi-http package has a vulnerability that causes a panic when a zero timeout is supplied. It is essential to update to the patched versions to ensure the stability and security of applications using this package. Additionally, developers should avoid using zero timeouts as a temporary measure.
See every vulnerability recorded for wasmtime-wasi-http →
FAQ
The CVSS score of this vulnerability is 5.9, indicating a moderate level of severity.
The affected versions are 46.0.0 and 49.0.0. The vulnerability is fixed in versions 48.0.4 and 49.0.2.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit the Vulert playground at Vulert Scanner to check if your application is affected without needing to sign up.
If the vulnerability is not fixed, applications using the affected versions may experience crashes or unexpected behavior due to the panic triggered by a zero timeout.
Yes, you can avoid this vulnerability by ensuring that you do not supply a zero timeout when making HTTP requests with the wasmtime-wasi-http package.
References
Related vulnerabilities
Recent vulnerabilities recorded for wasmtime-wasi-http.
