Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 Forwarded Trailers Header Filter Bypass

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-121440 · CVE overview and exploitation status

EUVD-2026-115862

GHSA-j86m-34pm-p9mv

RUSTSEC-2026-0377

GHSA-jxcf-8qw5-5c33

cve-program · CVE-2026-121440

• https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-jxcf-8qw5-5c33
• https://www.vulncheck.com/advisories/wasmtime-46.0.0-before-48.0.7-and-49.0.0-before-49.0.4-forwarded-trailers-header-filter-bypass

euvd · EUVD-2026-115862

• https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-jxcf-8qw5-5c33
• https://www.vulncheck.com/advisories/wasmtime-46.0.0-before-48.0.7-and-49.0.0-before-49.0.4-forwarded-trailers-header-filter-bypass

nvd · CVE-2026-121440

• https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-jxcf-8qw5-5c33
• https://www.vulncheck.com/advisories/wasmtime-46.0.0-before-48.0.7-and-49.0.0-before-49.0.4-forwarded-trailers-header-filter-bypass

osv · RUSTSEC-2026-0377

• https://crates.io/crates/wasmtime-wasi-http
• https://rustsec.org/advisories/RUSTSEC-2026-0377.html
• https://github.com/bytecodealliance/wasmtime/pull/14823

• `wasi-http` p3: forwarded trailers aren't checked against `is_forbidden_header` hook · Advisory content revised · 4 Nov 2026
• Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 Forwarded Trailers Header Filter Bypass · Newly collected advisory · 3 Nov 2026