crates.io/wasmtime: critical 9.9

Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation

Action: Upgrade wasmtime to 36.0.19 (36.x) or 43.0.0 (43.x) or later.

cargo update -p wasmtime --precise 36.0.19

cargo update -p wasmtime --precise 43.0.0

Affected

Fixed versions

Sources

• osv: GHSA-897f-g5gm-fmxm
• https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-897f-g5gm-fmxm
• https://github.com/bytecodealliance/wasmtime/pull/12613
• https://github.com/bytecodealliance/wasmtime/pull/14818
• https://github.com/bytecodealliance/wasmtime/commit/ba8f7d70caa1825b7f64fa75cd9d03f4a438dae0
• https://github.com/bytecodealliance/wasmtime/commit/f517bd6e890c7c1291ab9fe05d8cc0c9f11e56aa
• https://github.com/bytecodealliance/wasmtime
• https://github.com/bytecodealliance/wasmtime/releases/tag/v36.0.19
• https://github.com/bytecodealliance/wasmtime/releases/tag/v43.0.0
• https://rustsec.org/advisories/RUSTSEC-2026-0380.html

published 2026-10-23T22:02:20Z · modified 2026-10-23T22:15:04.434177428Z · JSON