Four advisories against the zstd crates, published October 2026, failed
the repository check on every pull request:
- RUSTSEC-2026-0391 (zstd < 0.14.3): data from an abandoned stream leaks
into the next stream on a reused context;
- RUSTSEC-2026-0398 (zstd-safe < 8.2.0): Seekable::decompress sets a Vec
length past its capacity;
- RUSTSEC-2026-0403 (zstd-safe < 8.2.0): uninitialised memory when a
legacy frame's streaming decompression fails;
- RUSTSEC-2026-0410 (zstd-sys < 2.1.2): the wasm allocator shim corrupts
memory on allocation failure.
Every direct use moves: wai (zstd 0.14.3, zstd-safe 8.2), jwp and
joule-moq-interop (zstd 0.14.3). Five lockfiles change exactly the three
zstd packages and nothing else: wai-rs, wai-rs/fuzz, joule-code-rs,
joule-moq-room and examples/transport-moqt.
The one copy left is wasmtime 49's, under wasmtime-internal-cache, which
compresses compiled modules for wasmtime's on-disk cache. sandbox-exec-wasm
builds its engine from Config::new() with fuel metering only and never
configures a cache, so zstd's code does not run in the sandbox. It is
allowed in scripts/check-advisories.py at those exact versions, so a
direct use regressing to them is not excused.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
1a514b243c