WASMTIME · CVE-2026-126409 · Runtime
NO FIX YET · SEE WHAT TO DO
Wasmtime's StructType::with_finality_and_supertype does not check that a supertype belongs to the same Engine, so mixing engines can cause runtime panics or GC heap corruption. The result is denial of service; guest WebAssembly code cannot trigger it.
first public Oct 29, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Only embedders that run several Wasmtime Engine instances in one process and create GC struct types using a supertype from another engine can hit this. Guest WebAssembly modules cannot trigger it, so single-engine hosts and plain Wasm runners are unlikely to be exposed.
Not affected if guest-only-wasm, single-engine, wasmtime-outside-affected-ranges
Who cares rust, wasmtime, webassembly
wasmtime --version or the wasmtime crate version in Cargo.lock.48.0.849.0.550.0.1Wasmtime 47.0.0 before 48.0.8, 49.0.0 before 49.0.5, and 50.0.0 before 50.0.1 contains a cross-engine type confusion vulnerability because StructType::with_finality_and_supertype does not validate that the supplied supertype belongs to the same Engine. Embedders using multiple engines that create a GC struct type with another engine's supertype can trigger runtime panics or GC heap corruption, causing denial of service; guest WebAssembly cannot trigger it.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.