[renovate]

This PR contains the following updates:

Package	Type	Update	Change
wasmtime-wasi-http		major	49.0.2 → 50.0.0
wasmtime-wasi-http	dependencies	patch	49.0.2 → 49.0.4

---

Guests can send absolute-form HTTP requests to different hosts

GHSA-5qpp-g3j2-8frx / RUSTSEC-2026-0350

More information

Details

This is an entry in the RustSec database for the Wasmtime security advisory
located at
GHSA-5qpp-g3j2-8frx
For more information see the GitHub-hosted security advisory.

Severity

• CVSS Score: 2.1 / 10 (Low)
• Vector String: CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

• https://crates.io/crates/wasmtime-wasi-http
• https://rustsec.org/advisories/RUSTSEC-2026-0350.html
• https://github.com/bytecodealliance/wasmtime/pull/14727

This data is provided by OSV and the Rust Advisory Database (CC0 1.0).

---

wasi-http: Request with long url before query parameter crashes host

GHSA-w36r-2hch-9xp9 / RUSTSEC-2026-0351

More information

Details

This is an entry in the RustSec database for the Wasmtime security advisory
located at
GHSA-w36r-2hch-9xp9
For more information see the GitHub-hosted security advisory.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

• https://crates.io/crates/wasmtime-wasi-http
• https://rustsec.org/advisories/RUSTSEC-2026-0351.html
• https://github.com/bytecodealliance/wasmtime/pull/14728

This data is provided by OSV and the Rust Advisory Database (CC0 1.0).

---

wasi-http p3: Guests can set incorrect content-length for spliced response bodies

GHSA-9prg-84vf-g5fc / RUSTSEC-2026-0375

More information

Details

This is an entry in the RustSec database for the Wasmtime security advisory
located at
GHSA-9prg-84vf-g5fc
For more information see the GitHub-hosted security advisory.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References

• https://crates.io/crates/wasmtime-wasi-http
• https://rustsec.org/advisories/RUSTSEC-2026-0375.html
• https://github.com/bytecodealliance/wasmtime/pull/14822

This data is provided by OSV and the Rust Advisory Database (CC0 1.0).

---

wasi-http: Guests can add conflicting content lengths to messages

GHSA-r8xh-cgf7-392j / RUSTSEC-2026-0376

More information

Details

This is an entry in the RustSec database for the Wasmtime security advisory
located at
GHSA-r8xh-cgf7-392j
For more information see the GitHub-hosted security advisory.

Severity

• CVSS Score: 3.7 / 10 (Low)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

References

• https://crates.io/crates/wasmtime-wasi-http
• https://rustsec.org/advisories/RUSTSEC-2026-0376.html
• https://github.com/bytecodealliance/wasmtime/pull/14824

This data is provided by OSV and the Rust Advisory Database (CC0 1.0).

---

wasi-http p3: forwarded trailers aren't checked against is_forbidden_header hook

GHSA-jxcf-8qw5-5c33 / RUSTSEC-2026-0377

More information

Details

This is an entry in the RustSec database for the Wasmtime security advisory
located at
GHSA-jxcf-8qw5-5c33
For more information see the GitHub-hosted security advisory.

Severity

• CVSS Score: 3.7 / 10 (Low)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

References

• https://crates.io/crates/wasmtime-wasi-http
• https://rustsec.org/advisories/RUSTSEC-2026-0377.html
• https://github.com/bytecodealliance/wasmtime/pull/14823

This data is provided by OSV and the Rust Advisory Database (CC0 1.0).

---

Release Notes

bytecodealliance/wasmtime (wasmtime-wasi-http)

v50.0.0

Compare Source

50.0.0

Released 2026-10-20.

Added

• Wasmtime now supports the WebAssembly compact imports proposal, disabled by
  default, via Config::wasm_compact_imports.
  #​14335

• The Wasmtime CLI now has options to configure unsafe intrinsics and
  compile-time builtins.
  #​14279

• The Wasmtime CLI and C API can now enable the component model's canonical
  names and accessors features.
  #​14344
  #​14497

• A new Store::gc_heap_grow method can be used to manually grow the GC heap
  of a store.
  #​14341

• A new ResourceAny::resource_drop_concurrent method can be used to drop a
  guest resource with only an Accessor.
  #​14362

• A new Engine::release_idle_pool_memory method can be used to release memory
  kept resident by the pooling allocator for idle slots.
  #​14419
  #​14507

• A new off-by-default task-group-hook feature enables embedders to associate
  guest-to-host calls with their corresponding host-to-guest calls when using
  component-model-async.
  #​14416

• The wasmtime-wasi and wasmtime-wasi-http crates now support "named
  imports", the implements field of the component model.
  #​14275

• The wasmtime explore command now supports components and has resizable
  panes.
  #​14426
  #​14427
  #​14458

• The debugger now exposes shared memories to gdbstub.
  #​14087

• Winch now supports tail calls on x86_64 and AArch64.
  #​14349

• Cranelift has initial support for some x86_64 APX instructions.
  #​13916

• The wasmtime serve command can now inherit listening sockets from a service
  manager (e.g. systemd socket units) with a new --systemd-listenfd option,
  can serve on Unix sockets, and can automatically exit when idle with a new
  --idle-process-timeout option.
  #​14294
  #​14320
  #​14392

Changed

• Epoch deadline and call-hook callbacks now receive a StoreHookState
  instead of a StoreContextMut, which only allows access to the T in a
  Store<T>.
  #​14386

• The wasmtime CLI no longer enables WASIp0 (wasi_unstable) by default. It
  can be enabled with -Spreview0.
  #​14479

• Winch no longer enables the GC types, exceptions, or tail-call proposals by
  default as support for these is not yet Tier 1.
  #​14449
  #​14502

• Accessor::spawn now takes an async closure instead of an AccessorTask.
  #​14376

• Component-model-async has been updated to the latest specification: the
  cancellable immediate has been removed from intrinsics, subtask.cancel
  semantics have been refined, task.cancel now traps before the cancel event
  is delivered, and use of stream/future handles after the other end has been
  dropped now traps.
  #​14244
  #​14340
  #​14342
  #​14378
  #​14382

• Component-model-async now periodically yields during concurrent work to avoid
  starving other host tasks.
  #​14460

• The performance of async guest-to-host calls in component-model-async has
  been improved by lazily creating host tasks, and sync-to-sync adapters no
  longer need to call {enter,exit}-sync-call in many cases.
  #​14350
  #​14270

• Wasmtime now drops cached compiler contexts between compiling
  modules/components, reducing sustained memory usage.
  #​14314

• Cranelift's alias analysis is faster and more precise, and GC struct fields,
  array elements, and GC header fields now all have their own alias regions.
  #​14290
  #​14425
  #​14351
  #​14353

• Wasmtime now uses bulk libunwind section registration when available.
  #​14304

• Fuel is now charged for more host allocations made with Val.
  #​14415

• Default wasi:http hooks now classify connection and TLS errors in more
  detail.
  #​14501

• wasi:http now always accepts an empty path-with-query.
  #​14446

• The CLI now rejects zero for the --http-outgoing-body-* options.
  #​14448

• Work continues on implementing the stack-switching proposal.
  #​14140
  #​14369
  #​14398
  #​14441

• Wasmtime now requires Rust 1.97.0 to compile.
  #​14466

• The pooling allocator now scans further than a fixed set of region and
  additionally correctly resets pages that have been paged out.
  #​14357

Fixed

• Converting a borrowed Resource<T> or ResourceDynamic created with
  new_borrow into a ResourceAny outside of a component call no longer
  panics. The borrow is now lowered into the guest when the call happens, and
  ResourceAny::resource_drop is no longer required for such borrows.
  #​14384

• Recursive run_concurrent is now allowed for disparate stores.
  #​14302

• Fuel is now correctly saved and restored around call_ref and exception
  catches in Cranelift, and buffered fuel charges in a module's start function
  are no longer dropped.
  #​14407
  #​14391

• The check-write budget is now enforced in wasi:http outgoing bodies and
  some wasi:io output streams.
  #​14408
  #​14429
  #​14505

• Store::set_epoch_deadline no longer overflows with very large deltas.
  #​14513

• JIT code is now made coherent with the instruction cache correctly on
  AArch64.
  #​14454

• Native stack-walking on macOS arm64 has been fixed.
  #​14303

• A stack overflow translating a variant with a huge number of cases between
  components has been fixed.
  #​14355

• Resource aliases are now preserved when stubbing unknown imports.
  #​14396

• bindgen! now uses fully-qualified paths for prelude types to avoid
  collisions with WIT type names.
  #​14543

• Validation of if without else in the presence of subtyping has been fixed.
  #​14334

• A debug assertion in ref.test of internalized externrefs has been fixed.
  #​14315

• Cranelift now allows returns via xmm1 with WindowsFastCall for
  extern "Rust".
  #​14361

• cranelift-object now sets symbol flags correctly and returns an error,
  instead of panicking, for data objects declared with different TLS values.
  #​14519
  #​14469

• Winch now handles unreachable try_table, emits fuel updates before throwing
  exceptions, and preserves typed select result types for GC stack maps.
  #​14379
  #​14297
  #​14455

• wasmtime run now honors the --http-outgoing-body-* options.
  #​14440

• Graceful shutdown of wasmtime serve has been fixed.
  #​14388

• The CLI no longer panics on overflow when deriving the async stack size.
  #​14514

• A number of wasi:filesystem fixes: set-times on directory descriptors,
  stat of symlinks with trailing slashes, the stat fast path, datetime
  overflow, and directory entry file types on filesystems without d_type.
  #​14420
  #​14387
  #​14368
  #​14403
  #​14381

• Accepted TCP sockets now preserve their peer address after a reset.
  #​14443

• MACH_RCV_INTERRUPT is no longer used in the macOS mach ports
  implementation.
  #​14414

• wasi-http p3: Correctly enforce content-length for response bodies
  #​14822

• wasi-http p3: Apply forbidden header check to trailers
  #​14823

• wasi-http: Prohibit duplicate content-length headers
  #​14824

• Cranelift/aarch64: fix br_tables with very large target count
  #​14826

• Centralize type-checks of futures/streams
  #​14827

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.