CVE-2026-126406 · Runtime
NO FIX YET · SEE WHAT TO DO
Wasmtime's WASI HTTP p2 code can send outgoing requests with conflicting or mismatched content-length headers when a guest reuses a received response's headers. A non-compliant server can then treat the request as smuggled, which may bypass the embedder's destination access controls.
first public Oct 29, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Only embedders running Wasmtime with the wasmtime-wasi-http p2 implementation, where guest code sends outgoing HTTP requests, are exposed. The flaw depends on a guest reusing a response's headers and on the destination server being non-compliant with content-length handling. Teams not using WASI HTTP outgoing requests can skip it.
Not affected if no-outgoing-requests, no-wasi-http, versions-patched
Who cares wasi, wasmtime, webassembly
wasmtime --version or the wasmtime crate version in Cargo.lock.wasmtime-wasi-http with the p2 HTTP implementation and guest code that sends outgoing requests.36.0.20 on the 36 line, 48.0.8 on the 48 line, 49.0.5 on the 49 line, or 50.0.1 on the 50 line.The wasmtime-wasi-http p2 implementation in Wasmtime before 36.0.20, 37.0.0 before 48.0.8, 49.0.0 before 49.0.5, and 50.0.0 before 50.0.1 can send conflicting content-length headers, or ones not matching the body, in outgoing requests. A guest that reuses a received response's headers resource to send a bodyless request can enable request smuggling against non-compliant servers, potentially bypassing embedder destination access controls.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.