Live › vulnerability › CVE-2026-121440
Wasmtime's WASI HTTP p3 implementation does not run forwarded trailers through the embedder's forbidden-header hook. A WASIp3 guest can therefore forward trailers that the host meant to block, undermining header restrictions.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 15:22 UTC. All times on this page are UTC.
Only embedders running Wasmtime 46.0.0 to before 48.0.7, or 49.0.0 to before 49.0.4, that serve WASIp3 guests through wasi-http and rely on a custom WasiHttpHooks::is_forbidden_header filter to restrict headers. Applications that do not run untrusted WASIp3 guests or do not customize forbidden headers are unlikely to be meaningfully exposed.
No product ranges from the sources yet.
wasmtime --version or in the project's Cargo.lock for wasmtime.WasiHttpHooks implementation that defines is_forbidden_header.48.0.7 for the 48.x line49.0.4 for the 49.x lineEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 fails to check forwarded trailers against the WasiHttpHooks::is_forbidden_header hook in wasi-http p3. WASIp3 guests can forward a request or response body so its trailers skip embedder-customized forbidden header filtering, undermining header restrictions the embedder intended.
This page as .md · .json · in your agent: get_signal("CVE-2026-121440")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.