RUSTSEC-2026-0422: Typed functions with `i31` or `nullref` arguments may panic due to insufficient type-check

Q: What level of access and interaction does exploitation require?

The advisory rates the attack vector as adjacent network, with high attack complexity and high privileges required. It also requires user interaction.

Q: What is the expected security impact?

The reported impact is limited to availability. The advisory reports no confidentiality or integrity impact.

Q: Which deployments are relevant?

The advisory applies to the Rust wasmtime software. The supplied data does not identify affected or fixed versions, default-configuration exposure, or a workaround.

Published Oct 29, 2026

Updated

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-3982-jqvv-277m For more information see the GitHub-hosted security advisory.

Affected Software

3 affected componentsFixes available

rust/wasmtime>=47.0.0<48.0.8

48.0.8

rust/wasmtime>=49.0.0<49.0.5

49.0.5

rust/wasmtime>=50.0.0<50.0.1

50.0.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade rust/wasmtime to a version that resolves this vulnerability.
Fixed in 48.0.8
Upgrade
Upgrade rust/wasmtime to a version that resolves this vulnerability.
Fixed in 49.0.5
Upgrade
Upgrade rust/wasmtime to a version that resolves this vulnerability.
Fixed in 50.0.1

Event History

Oct 29, 2026

Advisory Published

via OSV·12:00 PM

Data Sourced

via OSV·12:00 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What level of access and interaction does exploitation require?

The advisory rates the attack vector as adjacent network, with high attack complexity and high privileges required. It also requires user interaction.

What is the expected security impact?