Upcoming Security Release for Wasmtime on 2026-02-24

[Alex Crichton]

The Wasmtime project would like to announce a forthcoming security release of Wasmtime.

The release will be made available on 2026-02-24 at approximately 18:00 UTC. Additionally, an advisory will be made available on the same date and time at https://github.com/advisories.

The highest severity issue fixed in this release is MODERATE based on the classification scheme defined by CVSS.

[Alex Crichton]

[Update 2026-02-24] Security releases available

Wasmtime versions 24.0.6, 36.0.6, 40.0.4, 41.0.4, and 42.0.0 are now available on crates.io. Additionally, binary releases are available on Github for the Wasmtime C-API shared library and CLI at https://github.com/bytecodealliance/wasmtime/releases.

These releases fix the following security issues rated MODERATE: 

Guest-controlled resource exhaustion in WASI implementations 

https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-852m-cvvp-9p4w

Panic when dropping a `[Typed]Func::call_async` future 

https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-xjhv-v822-pf94

Panic adding excessive fields to a `wasi:http/types.fields` instance

https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-243v-98vx-264h