RUSTSEC-2026-0422 GHSA-3982-jqvv-277m

Typed functions with `i31` or `nullref` arguments may panic due to insufficient type-check

Low crates.io

Severity: 1.8 / 10; Low · CVSS 3.1
Exploit chance (EPSS): —; No score published
Known exploited: No; Not in CISA's catalog
Weakness: —; Not classified
Fix: 50.0.1; Upgrade wasmtime to this version or later

Description

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-3982-jqvv-277m For more information see the GitHub-hosted security advisory.

Affected versions

crates.io

Package	Vulnerable	Fixed in
wasmtime	`>= 47.0.0, < 48.0.8` `>= 49.0.0, < 49.0.5` `>= 50.0.0, < 50.0.1`	`48.0.8` `49.0.5` `50.0.1`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

wasmtime crates.io → `50.0.1`

cargo

cargo update -p wasmtime --precise 50.0.1

Severity breakdown

CVSS 3.1 1.8

CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:L

Attack vector: Adjacent
Attack complexity: High
Privileges required: High
User interaction: Required
Scope: Unchanged
Confidentiality: None
Integrity: None
Availability: Low

References

Advisories

rustsec.org/advisories/RUSTSEC-2026-0422.html

Packages

crates.io/crates/wasmtime

Timeline

Oct 29, 2026 Published
Oct 30, 2026 Last updated by the source

Advisory	Severity	Why it's related
RUSTSEC-2026-0424 Unchecked memory usage in transferring borrowed resources between components	Not rated yet	Also affects wasmtime
RUSTSEC-2026-0423 Cross-engine type confusion with host-created struct-types-with-supertypes	Not rated yet	Also affects wasmtime
RUSTSEC-2026-0379 Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction	Critical	Also affects wasmtime
GHSA-9pvw-hwfg-92h5 Wasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload type	Medium	Also affects wasmtime
GHSA-897f-g5gm-fmxm Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation	Critical	Also affects wasmtime
RUSTSEC-2026-0364 Exception tags can cause host data structures to be unaligned	Not rated yet	Also affects wasmtime
RUSTSEC-2026-0363 Component-model handle tables are capped only per instance and charged to no limit	Medium	Also affects wasmtime
RUSTSEC-2026-0361 Panic when pending calls are run after a trap	Not rated yet	Also affects wasmtime

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor