Changes.Watch~ upgrade verdicts ~
Free digest
ExploitedPHP2Shell is now on CISA KEV

critical vulnerability

Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction

Fix availableCritical · CVSS 9.9EPSS 0.43%

Published Oct 28, 2026 · updated Oct 28, 2026

What to do

  1. Upgrade to a fixed version: wasmtime 36.0.19, wasmtime 48.0.7, wasmtime 49.0.4.
  2. Redeploy and restart long-running processes so they load the fixed code.

Affected packages

crates.iowasmtime

Vulnerable versions
< 36.0.19
Fixed in
36.0.19

Check your project: cargo tree -i wasmtime

crates.iowasmtime

Vulnerable versions
>= 37.0.0, < 48.0.7
Fixed in
48.0.7

Check your project: cargo tree -i wasmtime

crates.iowasmtime

Vulnerable versions
>= 49.0.0, < 49.0.4
Fixed in
49.0.4

Check your project: cargo tree -i wasmtime

What changed

  1. Oct 28, 2026

    Published in the GitHub Advisory Database as critical.

Sources

CWE-691 Insufficient Control Flow Management

← All critical vulnerabilities