GHSA-3982-jqvv-277m
Typed functions with `i31` or `nullref` arguments may panic due to insufficient type-check
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-3982-jqvv-277m For more information see the GitHub-hosted security advisory.
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- High
- Privileges needed
- High
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
What each source reports
OSV Score usedRUSTSEC-2026-0422
Typed functions with `i31` or `nullref` arguments may panic due to insufficient type-check
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-3982-jqvv-277m For more information see the GitHub-hosted security advisory.
- Record
RUSTSEC-2026-0422- CVSS 3.1
- 1.8 Low
CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
wasmtimecrates.io | 47.0.0 up to 48.0.8, 49.0.0 up to 49.0.5, 50.0.0 up to 50.0.1 | 48.0.849.0.550.0.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-3982-jqvv-277m is a low vulnerability (CVSS 1.8) in wasmtime, published October 29, 2026. No source lists public exploit code. Fixed in wasmtime 48.0.8.