Upcoming Security Release for Wasmtime on 2026-05-21

[Alex Crichton]

The Wasmtime project would like to announce a forthcoming security release of Wasmtime.

The releases 44.0.2, 36.0.10, and 24.0.9 will be made available on 2026-05-21 at approximately 18:00 UTC. Additionally, an advisory will be made available on the same date and time at https://github.com/advisories.

Additionally, the Wasmtime release of 45.0.0 will be delayed until 2026-05-21 in order to include this fix.

The highest severity issue fixed in this release is HIGH based on the classification scheme defined by CVSS.

[Patrick Hickey]

[Update 2026-05-21] Security releases available

Wasmtime versions 45.0.0, 44.0.2, 36.0.10, and 24.0.9, are now available on crates.io. Additionally, binary releases are available on Github for the Wasmtime C-API shared library and CLI at https://github.com/bytecodealliance/wasmtime/releases.

This release fixes the following security issues rated HIGH:

 

WASI path_open(TRUNCATE) bypasses `FilePerms::WRITE` host restriction
https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-2r75-cxrj-cmph