---
id: "CVE-2026-119135"
kind: "vulnerability"
aliases: ["CVE-2026-119135"]
title: "Wasmtime: type mismatch on component stream read crashes the host process"
severity: "medium"
cvss: 5.9
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["embedders", "runtime", "rust", "wasmtime", "webassembly"]
not_affected_if: ["no-component-model-streams", "trusted-guests-only", "wasmtime-cli-only"]
published_at: "2026-10-29T16:18:06+00:00"
first_seen_at: "2026-10-29T16:25:58+00:00"
updated_at: "2026-10-29T16:31:41+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119135", "first_seen_at": "2026-10-29T16:25:58+00:00"}]
---

# Wasmtime: type mismatch on component stream read crashes the host process

Wasmtime versions 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 panic when the host reads a component model stream as a different Rust type than it was created with. Guest code can trigger this by returning a host-created stream that the embedder reads with a mismatched type, crashing the embedding process.

_Summary, check and fix written by a model from the sources; labelled as such._

## Fix

- Upgrade Wasmtime 46.x to `48.0.6` or later
- Upgrade Wasmtime 49.x to `49.0.3` or later

## Timeline

- 2026-10-29T16:25:58+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119135

## From the sources

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 panics when the host reads a component model stream as a different Rust item type than it was created with, because the host-to-host read path asserts matching TypeIds instead of returning an error. Guest code can return a host-created StreamReader<U> that the embedder reads as StreamReader<T>, where both types map to the same component model type, crashing the embedding process.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_