bytecodealliance/wasmtime v48.0.8

on GitHub

48.0.8

Fixed 2026-10-29.

Fixed

• wasi-sockets: UDP connect only required the address to be permitted for
  sending or receiving, allowing guests to send datagrams to addresses denied
  for UdpSend.
  GHSA-hmmr-87qq-258j

• Cross-engine type confusion with host-created struct-types-with-supertypes
  has been fixed.
  GHSA-qw58-7h65-crq2

• Panic with typed functions with i31 or nullref arguments has been fixed.
  GHSA-3982-jqvv-277m

• Unchecked memory usage in transferring borrowed resources between components
  has been fixed.
  GHSA-6fr9-xmw9-5352

• Fixed a possibility of content-length being invalid or not matching body
  length in wasi-http p2.
  GHSA-h4wp-g4x3-7398

• Compiling a module with more than ~32k data segments with copy-on-write
  memory initialization disabled no longer panics with MemFlagsSetOverflow.
  #15050