48.0.5
Released 2026-10-02.
Fixed
- Fixed an issue where artifacts for 48.0.4 didn't get correctly published from CI and a GitHub release for 48.0.4 wasn't made. #14494
48.0.4
Released 2026-10-02.
Fixed
-
WASI preview 0 implementation of
poll_oneoffcircumvents fuel consumption. GHSA-j366-h8gg-77pm -
Excessive allocated memory on the host when guests don't have stdio. GHSA-gqmc-89g8-p25r
-
fd_readdircopies uninitialized struct padding into guest memory. GHSA-96f6-r43r-8c24 -
Guest can panic host through filesystem timestamp before the epoch on wasip3. GHSA-mr2v-56j5-cmfc
-
Wasmtime component async-lifted callback result count is unvalidated, causing a native stack buffer overflow. GHSA-32h6-97mm-8q3c
-
Mis-typed WebAssembly tag imports can lead to GC heap corruption. GHSA-cfhf-m2cr-62wj
-
Wasmtime wasi:http implementation panics with a zero timeout supplied. GHSA-w4qr-p94g-mjhv
-
Rooting for GC values live across
try_callmay be missing, causing GC heap corruption. GHSA-hw8m-q44c-ggrf