CVE-2026-126408 · Package
NO FIX YET · SEE WHAT TO DO
Wasmtime's TypedFunc embedder API fails to type-check I31 and Option<NoneRef> parameters and results, reaching an unreachable!() path. A malicious WebAssembly guest module can make the host embedding panic, causing denial of service.
first public Oct 29, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Applications that embed Wasmtime and run untrusted WebAssembly guest modules are exposed, because a malicious guest can panic the host process. Programs that only run trusted modules or do not embed Wasmtime can skip it.
Not affected if no-embedding, trusted-modules-only
Who cares rust, wasmtime, webassembly
Cargo.lock) and compare it with the fixed versions below.48.0.8 for the 47.x and 48.x line before the fix49.0.5 for the 49.x line50.0.1 for the 50.x lineWasmtime 47.0.0 before 48.0.8, 49.0.0 before 49.0.5, and 50.0.0 before 50.0.1 contains an insufficient type-check in the TypedFunc embedder API for I31, Option<I31>, and Option<NoneRef> parameter or result types, reaching an unreachable!() path. A malicious guest module exporting a function that uses another anyref-hierarchy type can panic the host embedding, causing denial of service.
This page as .md · .json · CVSS:4.0/AV:A/AC:H/AT:P/PR:H/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.