# wasmtime-wasi (crates.io) vulnerabilities 11 known vulnerabilities (2 high, 5 medium, 3 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 50.0.1 (Oct 29, 2026): no advisory affects it - Newest unaffected release: 50.0.1 (Oct 29, 2026), the latest release - Weekly downloads: 335.6K - Dependents: 0 - Releases: 240 since 0.2.0 (Aug 21, 2019) - Registry: https://crates.io/crates/wasmtime-wasi - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - RUSTSEC-2026-0420: 48.0.0 to 48.0.7 (48.0.8 is outside it); 49.0.0 to 49.0.4 (49.0.5 is outside it); 50.0.0 (50.0.1 is outside it) - CVE-2026-118688: 0.2.0 to 36.0.17 (36.0.18 is outside it); 37.0.0 to 48.0.5 (48.0.6 is outside it); 49.0.0 to 49.0.2 (49.0.3 is outside it) - CVE-2026-115387: 0.2.0 to 36.0.15 (36.0.16 is outside it); 37.0.0 to 48.0.2 (48.0.3 is outside it); 49.0.0 (49.0.1 is outside it) - CVE-2026-115386: 0.2.0 to 36.0.16 (36.0.17 is outside it); 37.0.0 to 48.0.3 (48.0.4 is outside it); 49.0.0 to 49.0.1 (49.0.2 is outside it) - CVE-2026-115385: 46.0.0 to 48.0.3 (48.0.4 is outside it); 49.0.0 to 49.0.1 (49.0.2 is outside it) - CVE-2026-115381: 0.2.0 to 36.0.16 (36.0.17 is outside it); 37.0.0 to 48.0.3 (48.0.4 is outside it); 49.0.0 to 49.0.1 (49.0.2 is outside it) - CVE-2026-115380: 0.2.0 to 36.0.16 (36.0.17 is outside it); 37.0.0 to 48.0.3 (48.0.4 is outside it); 49.0.0 to 49.0.1 (49.0.2 is outside it) - CVE-2026-58494: 0.2.0 to 24.0.10 (24.0.11 is outside it); 25.0.0 to 36.0.11 (36.0.12 is outside it); 37.0.0 to 45.0.2 (45.0.3 is outside it); 46.0.0 (46.0.1 is outside it) - CVE-2026-54786: 0.2.0 to 24.0.9 (24.0.10 is outside it); 25.0.0 to 36.0.10 (36.0.11 is outside it); 37.0.0 to 44.0.2 (44.0.3 is outside it); 45.0.0 to 45.0.1 (45.0.2 is outside it) - CVE-2026-47261: 0.2.0 to 24.0.8 (24.0.9 is outside it); 25.0.0 to 36.0.9 (36.0.10 is outside it); 37.0.0 to 44.0.1 (44.0.2 is outside it) - CVE-2025-53901: 0.2.0 to 24.0.3 (24.0.4 is outside it); 25.0.0 to 33.0.1 (33.0.2 is outside it); 34.0.0 to 34.0.1 (34.0.2 is outside it) ## Advisories (11) ### [RUSTSEC-2026-0420](https://cve.now/RUSTSEC-2026-0420): wasip3 UDP \`send\` can deliver a datagram to an address only allowed for receiving - Severity: Unrated - Published: Oct 29, 2026 - Affected: from 48.0.0, fixed in 48.0.8; from 49.0.0, fixed in 49.0.5; from 50.0.0, fixed in 50.0.1. - Fixed in 48.0.8 (released Oct 29, 2026, the day of disclosure), 49.0.5 (released Oct 29, 2026, the day of disclosure) and 50.0.1 (released Oct 29, 2026, the day of disclosure). - The latest release, 50.0.1, is not affected. ### [CVE-2026-118688](https://cve.now/CVE-2026-118688): Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 Sandbox Escape via Symlink Rename - Severity: High 8.8 - Published: Oct 28, 2026 - Affected: fixed in 36.0.18; from 37.0.0, fixed in 48.0.6; from 49.0.0, fixed in 49.0.3. - Fixed in 36.0.18 (released Oct 14, 2026, 14 days before disclosure), 48.0.6 (released Oct 14, 2026, 14 days before disclosure) and 49.0.3 (released Oct 14, 2026, 14 days before disclosure). - The latest release, 50.0.1, is not affected. ### [CVE-2026-115387](https://cve.now/CVE-2026-115387): Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 Host Panic via WASI Filesystem Timestamp Overflow - Severity: Medium 6.9 - Published: Oct 22, 2026 - Affected: fixed in 36.0.16; from 37.0.0, fixed in 48.0.3; from 49.0.0, fixed in 49.0.1. - Fixed in 36.0.16 (released Sep 24, 2026, 28 days before disclosure), 48.0.3 (released Sep 24, 2026, 28 days before disclosure) and 49.0.1 (released Sep 24, 2026, 28 days before disclosure). - The latest release, 50.0.1, is not affected. ### [CVE-2026-115386](https://cve.now/CVE-2026-115386): Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Memory Disclosure via fd\_readdir - Severity: Low 2.1 - Published: Oct 22, 2026 - Affected: fixed in 36.0.17; from 37.0.0, fixed in 48.0.4; from 49.0.0, fixed in 49.0.2. - Fixed in 36.0.17 (released Oct 2, 2026, 20 days before disclosure), 48.0.4 (released Oct 2, 2026, 20 days before disclosure) and 49.0.2 (released Oct 2, 2026, 20 days before disclosure). - The latest release, 50.0.1, is not affected. ### [CVE-2026-115385](https://cve.now/CVE-2026-115385): Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 Host Panic via WASIp3 Timestamps - Severity: Medium 6.9 - Published: Oct 22, 2026 - Affected: from 46.0.0, fixed in 48.0.4; from 49.0.0, fixed in 49.0.2. - Fixed in 48.0.4 (released Oct 2, 2026, 20 days before disclosure) and 49.0.2 (released Oct 2, 2026, 20 days before disclosure). - The latest release, 50.0.1, is not affected. ### [CVE-2026-115381](https://cve.now/CVE-2026-115381): Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Unbounded Host Memory Allocation via SinkOutputStream write-zeroes - Severity: Medium 5.9 - Published: Oct 22, 2026 - Affected: fixed in 36.0.17; from 37.0.0, fixed in 48.0.4; from 49.0.0, fixed in 49.0.2. - Fixed in 36.0.17 (released Oct 2, 2026, 20 days before disclosure), 48.0.4 (released Oct 2, 2026, 20 days before disclosure) and 49.0.2 (released Oct 2, 2026, 20 days before disclosure). - The latest release, 50.0.1, is not affected. ### [CVE-2026-115380](https://cve.now/CVE-2026-115380): Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Fuel Limit Bypass DoS via WASI Preview 0 poll\_oneoff - Severity: Medium 5.1 - Published: Oct 22, 2026 - Affected: fixed in 36.0.17; from 37.0.0, fixed in 48.0.4; from 49.0.0, fixed in 49.0.2. - Fixed in 36.0.17 (released Oct 2, 2026, 20 days before disclosure), 48.0.4 (released Oct 2, 2026, 20 days before disclosure) and 49.0.2 (released Oct 2, 2026, 20 days before disclosure). - The latest release, 50.0.1, is not affected. ### [CVE-2026-58494](https://cve.now/CVE-2026-58494): Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destination - Severity: Medium 6.5 - Published: Jul 8, 2026 - Affected: fixed in 24.0.11; from 25.0.0, fixed in 36.0.12; from 37.0.0, fixed in 45.0.3; from 46.0.0, fixed in 46.0.1; fixed in 24.0.11; from 25.0.0, fixed in 36.0.12; from 37.0.0, fixed in 45.0.3; from 46.0.0, fixed in 46.0.1. - Fixed in 24.0.11 (released Jun 24, 2026, 14 days before disclosure), 36.0.12 (released Jun 24, 2026, 14 days before disclosure), 45.0.3 (released Jun 24, 2026, 14 days before disclosure) and 1 other version. - The latest release, 50.0.1, is not affected. ### [CVE-2026-54786](https://cve.now/CVE-2026-54786): Wasmtime: Leak in WASIp1 \`fd\_renumber\` implementation - Severity: Low 2.3 - Published: Jul 1, 2026 - Affected: fixed in 24.0.10; from 45.0.0, fixed in 45.0.2; from 25.0.0, fixed in 36.0.11; from 37.0.0, fixed in 44.0.3; fixed in 24.0.10; from 25.0.0, fixed in 36.0.11; from 37.0.0, fixed in 44.0.3; from 45.0.0, fixed in 45.0.2. - Fixed in 24.0.10 (released Jun 15, 2026, 16 days before disclosure), 36.0.11 (released Jun 15, 2026, 16 days before disclosure), 44.0.3 (released Jun 15, 2026, 16 days before disclosure) and 1 other version. - The latest release, 50.0.1, is not affected. ### [CVE-2026-47261](https://cve.now/CVE-2026-47261): Wasmtime: WASI path\_open(TRUNCATE) bypasses \`FilePerms::WRITE\` host restriction - Severity: High 7.5 - Published: Jun 15, 2026 - Affected: fixed in 24.0.9; from 25.0.0, fixed in 36.0.10; from 37.0.0, fixed in 44.0.2; from 45.0.0, fixed in 45.0.0; from 37.0.0, fixed in 44.0.2; from 25.0.0, fixed in 36.0.10; fixed in 24.0.9. - Fixed in 24.0.9 (released May 21, 2026, 25 days before disclosure), 36.0.10 (released May 21, 2026, 25 days before disclosure), 44.0.2 (released May 21, 2026, 25 days before disclosure) and 1 other version. - The latest release, 50.0.1, is not affected. ### [CVE-2025-53901](https://cve.now/CVE-2025-53901): Wasmtime has host panic with \`fd\_renumber\` WASIp1 function - Severity: Low 3.5 - Published: Jul 18, 2025 - Affected: fixed in 24.0.4; from 25.0.0, fixed in 33.0.2; from 34.0.0, fixed in 34.0.2. - Fixed in 24.0.4 (released Jul 18, 2025, the day of disclosure), 33.0.2 (released Jul 18, 2025, the day of disclosure) and 34.0.2 (released Jul 18, 2025, the day of disclosure). - The latest release, 50.0.1, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/crates.io/wasmtime-wasi Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.