48.0.7
Released 2026-10-19.
Fixed
- wasi-http: Guests can add conflicting content lengths to messages GHSA-r8xh-cgf7-392j
- wasi-http p3: forwarded trailers aren't checked against
is_forbidden_headerhook GHSA-jxcf-8qw5-5c33 - wasi-http p3: Guests can set incorrect content-length for spliced response bodies GHSA-9prg-84vf-g5fc
- Cranelift backend on aarch64 can jump to incorrect target on large Wasm
br_tableinstruction GHSA-mghf-wjfp-p5xm - Update rustls to 0.23.46 #14768
- Panic lowering a host-created component model stream into a guest that expects a different payload type. GHSA-9pvw-hwfg-92h5