v44.0.1: Release Wasmtime 44.0.1 (#13241)

44.0.1

Released 2026-04-30.

Fixed

• Panic when allocating a table exceeding the size of the host's address space.
  GHSA-p8xm-42r7-89xg

v43.0.2: Release Wasmtime 43.0.2 (#13240)

43.0.2

Released 2026-04-30.

Fixed

• Panic when allocating a table exceeding the size of the host's address space.
  GHSA-p8xm-42r7-89xg

v36.0.8: Release Wasmtime 36.0.8 (#13239)

36.0.8

Released 2026-04-30.

Fixed

• Panic when allocating a table exceeding the size of the host's address space.
  GHSA-p8xm-42r7-89xg

v24.0.8: Release Wasmtime 24.0.8 (#13238)

24.0.8

Released 2026-04-30.

Fixed

• Fixed a bug in lowering of f64.copysign on x86-64 whereby when combined
  with an f64.load, the resulting machine code could read 16 bytes rather
  than 8 bytes. This could result in a segfault when Wasmtime is configured
  without signals-based traps.
  GHSA-vc8c-j3xm-xj73

dev: Fix panicking overflow when calculating table sizes (#13245)

Return an error instead of panicking in the same manner that OOM is
handled.

v44.0.0: Release Wasmtime 44.0.0 (#13143)

44.0.0

Released 2026-04-20.

Added

• The wasmtime CLI now supports a -g flag which runs a built-in wasm program
  to host a gdbstub-compatible server (can be connected to with LLDB) to debug
  guest programs.
  #12756
  #12771
  #12856
  #12859

• Wasmtime now has experimental support for the map<K, V> type in the
  component model.
  #12216

• Wasmtime's C API now supports wasm tag types.
  #12763
  #12803

• Wasmtime's C API now supports exceptions.
  #12861

• Wasmtime's C API has more support for the GC proposal.
  #12914
  #12915
  #12916
  #12917

• An initial implementation of the wasi:tls proposal for the 0.3.0-draft
  version has been added.
  #12834

Changed

• The demangle Cargo feature of the wasmtime crate is now compatible with
  no_std targets.
  #12740

• The wasmtime-wasi-tls-* crates are now merged into one crate with feature
  flags for each backend.
  #12780

• Wasmtime now requires Rust 1.92.0 or later to build.
  #12828

• The cranelift-codegen crate now compiles for no_std targets.
  #12812

• The csdb instruction, a defense-in-depth measure for spectre, is no longer
  emitted by default on aarch64 to match what peer runtimes are doing. In some
  situations this is known to provide up to a 6x performance boost on macOS as
  well.
  #12932

Fixed

• Wasmtime's native DWARF has been improved on aarch64 to support recovering
  values more frequently.
  #12779

• A significant number of minor issues have been fixed throughout this release.
  In addition to the security advisories found by LLMs there have also
  been a large number of other issues identified as well. Many minor fixes are
  present in this release for various situations for issues found in this
  manner.

v43.0.1: Release Wasmtime 43.0.1 (#13001)

43.0.1

Released 2026-04-09.

Fixed

• Miscompiled guest heap access enables sandbox escape on aarch64 Cranelift.
  GHSA-jhxm-h53p-jm7w

• Wasmtime with Winch compiler backend may allow a sandbox-escaping memory
  access.
  GHSA-xx5w-cvp6-jv83

• Out-of-bounds write or crash when transcoding component model strings.
  GHSA-394w-hwhg-8vgm

• Host panic when Winch compiler executes table.fill.
  GHSA-q49f-xg75-m9xw

• Wasmtime segfault or unused out-of-sandbox load with f64x2.splat operator
  on x86-64.
  GHSA-qqfj-4vcm-26hv

• Improperly masked return value from table.grow with Winch compiler backend.
  GHSA-f984-pcp8-v2p7

• Panic when transcoding misaligned utf-16 strings.
  GHSA-jxhv-7h78-9775

• Panic when lifting flags component value.
  GHSA-m758-wjhj-p3jq

• Heap OOB read in component model UTF-16 to latin1+utf16 string transcoding.
  GHSA-hx6p-xpx3-jvvv

• Use-after-free bug after cloning wasmtime::Linker.
  GHSA-hfr4-7c6c-48w2

• Data leakage between pooling allocator instances.
  GHSA-6wgr-89rj-399p

• Host data leakage with 64-bit tables and Winch.
  GHSA-m9w2-8782-2946

v42.0.2: Release Wasmtime 42.0.2 (#13000)

42.0.2

Released 2026-04-09.

Fixed

• Miscompiled guest heap access enables sandbox escape on aarch64 Cranelift.
  GHSA-jhxm-h53p-jm7w

• Wasmtime with Winch compiler backend may allow a sandbox-escaping memory
  access.
  GHSA-xx5w-cvp6-jv83

• Out-of-bounds write or crash when transcoding component model strings.
  GHSA-394w-hwhg-8vgm

• Host panic when Winch compiler executes table.fill.
  GHSA-q49f-xg75-m9xw

• Wasmtime segfault or unused out-of-sandbox load with f64x2.splat operator
  on x86-64.
  GHSA-qqfj-4vcm-26hv

• Improperly masked return value from table.grow with Winch compiler backend.
  GHSA-f984-pcp8-v2p7

• Panic when transcoding misaligned utf-16 strings.
  GHSA-jxhv-7h78-9775

• Panic when lifting flags component value.
  GHSA-m758-wjhj-p3jq

• Heap OOB read in component model UTF-16 to latin1+utf16 string transcoding.
  GHSA-hx6p-xpx3-jvvv

• Data leakage between pooling allocator instances.
  GHSA-6wgr-89rj-399p

• Host data leakage with 64-bit tables and Winch.
  GHSA-m9w2-8782-2946

v36.0.7: Release Wasmtime 36.0.7 (#12999)

36.0.7

Released 2026-04-09.

Fixed

• Miscompiled guest heap access enables sandbox escape on aarch64 Cranelift.
  GHSA-jhxm-h53p-jm7w

• Wasmtime with Winch compiler backend may allow a sandbox-escaping memory
  access.
  GHSA-xx5w-cvp6-jv83

• Out-of-bounds write or crash when transcoding component model strings.
  GHSA-394w-hwhg-8vgm

• Host panic when Winch compiler executes table.fill.
  GHSA-q49f-xg75-m9xw

• Wasmtime segfault or unused out-of-sandbox load with f64x2.splat operator
  on x86-64.
  GHSA-qqfj-4vcm-26hv

• Improperly masked return value from table.grow with Winch compiler backend.
  GHSA-f984-pcp8-v2p7

• Panic when transcoding misaligned utf-16 strings.
  GHSA-jxhv-7h78-9775

• Panic when lifting flags component value.
  GHSA-m758-wjhj-p3jq

• Heap OOB read in component model UTF-16 to latin1+utf16 string transcoding.
  GHSA-hx6p-xpx3-jvvv

• Data leakage between pooling allocator instances.
  GHSA-6wgr-89rj-399p

• Host data leakage with 64-bit tables and Winch.
  GHSA-m9w2-8782-2946

v24.0.7: Release Wasmtime 24.0.7 (#12998)

24.0.7

Released 2026-04-09.

Fixed

• Out-of-bounds write or crash when transcoding component model strings.
  GHSA-394w-hwhg-8vgm

• Wasmtime segfault or unused out-of-sandbox load with f64x2.splat operator
  on x86-64.
  GHSA-qqfj-4vcm-26hv

• Panic when transcoding misaligned utf-16 strings.
  GHSA-jxhv-7h78-9775

• Panic when lifting flags component value.
  GHSA-m758-wjhj-p3jq

• Heap OOB read in component model UTF-16 to latin1+utf16 string transcoding.
  GHSA-hx6p-xpx3-jvvv