Upcoming Security Release for Wasmtime on 2026-06-24

[Patrick Hickey]

The Wasmtime project would like to announce a forthcoming security release of Wasmtime.

The releases 46.0.1, 45.0.3, 36.0.12, and 24.0.11 will be made available on 2026-06-24 at approximately 18:00 UTC. Additionally, an advisory will be made available on the same date and time at https://github.com/advisories.

The highest severity issue fixed in this release is MODERATE based on the classification scheme defined by CVSS.

The release 46.0.0 will go out as scheduled on 2026-06-20. The Wasmtime maintainers decided to not delay this release, based on the anticipated impact of this issue.

[Patrick Hickey]

[Update 2026-06-24] Security releases available

Wasmtime versions 24.0.11, 36.0.12, 45.0.3, and 46.0.1 are now available on crates.io. Additionally, binary releases are available on Github for the Wasmtime C-API shared library and CLI at https://github.com/bytecodealliance/wasmtime/releases.

This release fixes the following security issues rated MODERATE:

 

WASI hard links and renames bypass wasmtime-wasi's FilePerms for destination
https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-4ch3-9j33-3pmj