bytecodealliance/wasmtime v48.0.5

on GitHub

48.0.5

Released 2026-10-02.

Fixed

• Fixed an issue where artifacts for 48.0.4 didn't get correctly published from
  CI and a GitHub release for 48.0.4 wasn't made.
  #14494

48.0.4

Released 2026-10-02.

Fixed

• WASI preview 0 implementation of poll_oneoff circumvents fuel consumption.
  GHSA-j366-h8gg-77pm

• Excessive allocated memory on the host when guests don't have stdio.
  GHSA-gqmc-89g8-p25r

• fd_readdir copies uninitialized struct padding into guest memory.
  GHSA-96f6-r43r-8c24

• Guest can panic host through filesystem timestamp before the epoch on wasip3.
  GHSA-mr2v-56j5-cmfc

• Wasmtime component async-lifted callback result count is unvalidated, causing a native stack buffer overflow.
  GHSA-32h6-97mm-8q3c

• Mis-typed WebAssembly tag imports can lead to GC heap corruption.
  GHSA-cfhf-m2cr-62wj

• Wasmtime wasi:http implementation panics with a zero timeout supplied.
  GHSA-w4qr-p94g-mjhv

• Rooting for GC values live across try_call may be missing, causing GC heap corruption.
  GHSA-hw8m-q44c-ggrf