# Bytecode Alliance vulnerabilities Source: https://junglewise.ai/threats/vendors/bytecode-alliance Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 11 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/bytecode-alliance.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 63 vulnerabilities in Bytecode Alliance: 0 in the last 7 days and 50 in the last 90 days, 4 of them critical and 0 exploited in the wild. The most recent, CVE-2026-121439, was published on 3 November 2026. 43 vulnerabilities in the last four weeks, up 514% on the four before (7). 3 critical against 0. 2 technologies have a page of their own. ## Counts - Last 7 days: 0 - Last 30 days: 43 - Last 90 days: 50 - All time: 63 (4 critical, 0 exploited in the wild) ## About Bytecode Alliance Non-profit organization focused on developing and standardizing WebAssembly and related technologies. ## Latest Bytecode Alliance vulnerabilities - [CVE-2026-121439: Wasmtime wasi-http response splitting via unvalidated headers](https://junglewise.ai/threats/cve-2026-121439-wasmtime-46-0-0-before-48-0-7-and-49-0-0-before-49-0-4-contains) (medium, CVSS 5.3, published 3 Nov 2026) - [CVE-2026-119143: Wasmtime denial of service in component model stream operations](https://junglewise.ai/threats/cve-2026-119143-wasmtime-46-0-0-before-48-0-6-and-49-0-0-before-49-0-3-contains) (medium, CVSS 4.8, published 29 Oct 2026) - [CVE-2026-119142: Wasmtime host panic in call_async Future drop](https://junglewise.ai/threats/cve-2026-119142-wasmtime-46-0-0-before-48-0-6-and-49-0-0-before-49-0-3-contains) (medium, CVSS 4.8, published 29 Oct 2026) - [CVE-2026-119141: Wasmtime denial of service in realloc handling](https://junglewise.ai/threats/cve-2026-119141-wasmtime-46-0-0-before-48-0-6-and-49-0-0-before-49-0-3-contains) (medium, CVSS 5.3, published 29 Oct 2026) - [CVE-2026-119140: Wasmtime denial of service via thread.yield in component start](https://junglewise.ai/threats/cve-2026-119140-wasmtime-46-0-0-before-48-0-6-and-49-0-0-before-49-0-3-contains) (medium, CVSS 4.8, published 29 Oct 2026) - [CVE-2026-119139: Wasmtime host crash in async-lifted function invocation](https://junglewise.ai/threats/cve-2026-119139-wasmtime-46-0-0-before-48-0-6-and-49-0-0-before-49-0-3-contains) (medium, CVSS 4.8, published 29 Oct 2026) - [CVE-2026-119138: Wasmtime assertion failure after trap in pending calls](https://junglewise.ai/threats/cve-2026-119138-wasmtime-46-0-0-before-48-0-6-and-49-0-0-before-49-0-3-contains) (medium, CVSS 4.8, published 29 Oct 2026) - [CVE-2026-119137: Wasmtime stack overflow in recursive type drops](https://junglewise.ai/threats/cve-2026-119137-wasmtime-42-0-0-before-48-0-6-and-49-0-0-before-49-0-3-contains) (medium, CVSS 5.3, published 29 Oct 2026) - [CVE-2026-119136: Wasmtime async-entrypoint enforcement bypass](https://junglewise.ai/threats/cve-2026-119136-wasmtime-42-0-0-before-48-0-6-and-49-0-0-before-49-0-3-contains) (medium, CVSS 4.8, published 29 Oct 2026) - [CVE-2026-119135: Wasmtime panic in component model stream type mismatch](https://junglewise.ai/threats/cve-2026-119135-wasmtime-46-0-0-before-48-0-6-and-49-0-0-before-49-0-3-panics) (medium, CVSS 4.8, published 29 Oct 2026) - [CVE-2026-119134: Wasmtime component-model resource handle unbounded memory growth](https://junglewise.ai/threats/cve-2026-119134-wasmtime-before-36-0-18-37-0-0-before-48-0-6-and-49-0-0-before) (medium, CVSS 6.2, published 29 Oct 2026) - [CVE-2026-119132: Wasmtime host panic via overlapping string transcode in fused adapter](https://junglewise.ai/threats/cve-2026-119132-wasmtime-from-49-0-0-before-49-0-3-contains-a-denial-of-service) (medium, CVSS 4.8, published 29 Oct 2026) - [CVE-2026-119131: Wasmtime denial of service in wasmtime-wasi-http](https://junglewise.ai/threats/cve-2026-119131-wasmtime-46-0-0-before-48-0-6-and-49-0-0-before-49-0-3-contains) (medium, CVSS 5.3, published 29 Oct 2026) - [Wasmtime unchecked memory usage in borrowed resource transfer](https://junglewise.ai/threats/rustsec-2026-0424-unchecked-memory-usage-in-transferring-borrowed-b297503c) (info, published 29 Oct 2026) - [Wasmtime type confusion with host-created struct types](https://junglewise.ai/threats/rustsec-2026-0423-cross-engine-type-confusion-with-host-created-struct-89fe3f0e) (info, published 29 Oct 2026) - [CVE-2026-118688: Wasmtime filesystem sandbox escape via symlink rename](https://junglewise.ai/threats/cve-2026-118688-wasmtime-wasi-in-wasmtime-before-36-0-18-37-0-0-before-48-0-6) (high, CVSS 7.9, published 28 Oct 2026) - [CVE-2026-115893: Wasmtime Cranelift aarch64 br_table sandbox escape](https://junglewise.ai/threats/cve-2026-115893-wasmtime-is-a-runtime-for-webassembly-prior-to-36-0-19-48-0-7) (critical, CVSS 9.9, published 23 Oct 2026) - [CVE-2026-115892: Wasmtime component-model type-check bypass in stream/future lowering](https://junglewise.ai/threats/cve-2026-115892-wasmtime-is-a-runtime-for-webassembly-from-46-0-0-until-48-0-7) (medium, CVSS 4, published 23 Oct 2026) - [CVE-2026-115889: Wasmtime Cranelift SSA value index overflow](https://junglewise.ai/threats/cve-2026-115889-wasmtime-is-a-runtime-for-webassembly-prior-to-36-0-19-and-43-0) (critical, CVSS 9.9, published 23 Oct 2026) - [CVE-2026-115392: Wasmtime filesystem sandbox escape via symlink trailing slashes](https://junglewise.ai/threats/cve-2026-115392-wasmtime-before-24-0-13-25-0-0-before-36-0-14-37-0-0-before-46-0) (high, CVSS 7.9, published 22 Oct 2026) - [CVE-2026-115391: Wasmtime WASIp3 uncontrolled resource allocation in streams](https://junglewise.ai/threats/cve-2026-115391-wasmtime-46-0-0-before-46-0-3-and-47-0-0-before-47-0-4-contains) (medium, CVSS 5.8, published 22 Oct 2026) - [CVE-2026-115390: Wasmtime fuel accounting bypass in call_ref and try_table](https://junglewise.ai/threats/cve-2026-115390-wasmtime-47-0-0-before-48-0-3-and-49-0-0-before-49-0-1-contains) (medium, CVSS 5.7, published 22 Oct 2026) - [CVE-2026-115388: Wasmtime wasmtime-wasi-http memory exhaustion in HTTP body write](https://junglewise.ai/threats/cve-2026-115388-wasmtime-wasi-http-in-wasmtime-before-36-0-16-37-0-0-before-48-0) (medium, CVSS 6.2, published 22 Oct 2026) - [CVE-2026-115387: Wasmtime denial of service via WASI filesystem timestamp overflow](https://junglewise.ai/threats/cve-2026-115387-wasmtime-before-36-0-16-37-0-0-before-48-0-3-and-49-0-0-before) (medium, CVSS 6.2, published 22 Oct 2026) - [CVE-2026-115385: Wasmtime denial of service in WASIp3 timestamp handling](https://junglewise.ai/threats/cve-2026-115385-wasmtime-46-0-0-before-48-0-4-and-49-0-0-before-49-0-2-contains) (medium, CVSS 6.2, published 22 Oct 2026) ## Most severe Bytecode Alliance vulnerabilities - [CVE-2026-115893: Wasmtime Cranelift aarch64 br_table sandbox escape](https://junglewise.ai/threats/cve-2026-115893-wasmtime-is-a-runtime-for-webassembly-prior-to-36-0-19-48-0-7) (critical, CVSS 9.9, published 23 Oct 2026) - [CVE-2026-115889: Wasmtime Cranelift SSA value index overflow](https://junglewise.ai/threats/cve-2026-115889-wasmtime-is-a-runtime-for-webassembly-prior-to-36-0-19-and-43-0) (critical, CVSS 9.9, published 23 Oct 2026) - [CVE-2026-34987: Bytecode Alliance Wasmtime sandbox escape in Winch compiler backend](https://junglewise.ai/threats/cve-2026-34987-bytecode-alliance-wasmtime-sandbox-escape-in-winch-compiler) (critical, CVSS 9.9, published 9 Apr 2026) - [CVE-2026-115384: Wasmtime stack buffer overflow in component async callbacks](https://junglewise.ai/threats/cve-2026-115384-wasmtime-39-0-0-before-48-0-4-and-49-0-0-before-49-0-2-contains) (critical, CVSS 9.9, published 22 Oct 2026) - [CVE-2026-118688: Wasmtime filesystem sandbox escape via symlink rename](https://junglewise.ai/threats/cve-2026-118688-wasmtime-wasi-in-wasmtime-before-36-0-18-37-0-0-before-48-0-6) (high, CVSS 7.9, published 28 Oct 2026) - [CVE-2026-115392: Wasmtime filesystem sandbox escape via symlink trailing slashes](https://junglewise.ai/threats/cve-2026-115392-wasmtime-before-24-0-13-25-0-0-before-36-0-14-37-0-0-before-46-0) (high, CVSS 7.9, published 22 Oct 2026) - [CVE-2026-34971: Bytecode Alliance Wasmtime sandbox escape in Cranelift backend on aarch64](https://junglewise.ai/threats/cve-2026-34971-bytecode-alliance-wasmtime-sandbox-escape-in-cranelift-backend-on) (high, CVSS 7.8, published 9 Apr 2026) - [CVE-2026-44216: Bytecode Alliance Wasmtime denial of service via table allocation panic](https://junglewise.ai/threats/cve-2026-44216-bytecode-alliance-wasmtime-denial-of-service-via-table-allocation) (high, CVSS 7.5, published 14 May 2026) - [CVE-2026-47261: Bytecode Alliance Wasmtime access control bypass in wasmtime-wasi](https://junglewise.ai/threats/cve-2026-47261-bytecode-alliance-wasmtime-access-control-bypass-in-wasmtime-wasi) (high, CVSS 7.5, published 15 Jun 2026) - [CVE-2026-35186: Bytecode Alliance Wasmtime out-of-bounds access in Winch compiler](https://junglewise.ai/threats/cve-2026-35186-bytecode-alliance-wasmtime-out-of-bounds-access-in-winch-compiler) (high, CVSS 7.5, published 9 Apr 2026) ## Vulnerabilities per week 43 vulnerabilities in the last four weeks, up 514% on the four before (7). 3 critical against 0. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 1 | 0 | 0 | | 28 Sep 2026 | 6 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 11 | 0 | 0 | | 19 Oct 2026 | 16 | 3 | 0 | | 26 Oct 2026 | 15 | 0 | 0 | | 2 Nov 2026 | 1 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Bytecode Alliance technologies - [Bytecode Alliance Wasmtime](https://junglewise.ai/threats/technologies/bytecode-alliance-wasmtime): 55 vulnerabilities - [Bytecode Alliance Wasmtime-Wasi](https://junglewise.ai/threats/technologies/bytecode-alliance-wasmtime-wasi): 5 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Bytecode Alliance vulnerabilities", https://junglewise.ai/threats/vendors/bytecode-alliance, 11 November 2026.