49.0.3
Released 2026-10-14.
Fixed
-
Out-of-bounds zero-length stream writes can panic. GHSA-93g3-36p8-x2gc
-
Host panic when component
call_asyncis cancelled under some conditions. GHSA-3r89-v5mq-j5xf -
Panic on erroneous call-to-host from guest realloc call. GHSA-7v24-42x9-pxf7
-
Yielding in a component start function can lead to a host panic. GHSA-5hhx-4wrr-3j9g
-
Panic when invoking an async-lifted function via
call. GHSA-m6w2-jwq2-cv2c -
Panic when pending calls are run after a trap. GHSA-hmwq-g22x-qjw5
-
Stack overflow dropping a long chain of recursive types. GHSA-wjc8-633q-pwxr
-
Wasmtime may not properly enforce async-entrypoint requirement. GHSA-vcg5-q8m5-8379
-
Panic viewing component model stream or future as the wrong type. GHSA-63h4-6cx9-pjfj
-
Component-model handle tables are capped only per instance and charged to no limit. GHSA-q554-3cjc-rx7p
-
Exception tags can cause host data structures to be unaligned. GHSA-p79w-pv2r-29qp
-
Filesystem sandbox escape when renaming symlinks with trailing slashes. GHSA-m9f7-9w4p-gv38
-
Overlapping string transcode in a fused adapter can panic. GHSA-54p9-vhhq-8f7q
-
Guests can send absolute-form HTTP requests to different hosts. GHSA-5qpp-g3j2-8frx
-
wasi-http: Request with long url before query parameter crashes host. GHSA-w36r-2hch-9xp9
