{"record":{"id":"faa409f0da1748e0","repo":"crowdsecurity/crowdsec","slug":"failed-to-compile-obfuscator-wasm-module-w","errorCode":null,"errorMessage":"failed to compile obfuscator wasm module: %w","messagePattern":"failed to compile obfuscator wasm module: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"pkg/appsec/challenge/challenge.go","lineNumber":335,"sourceCode":"\t\t\tobfuscatorWasmErr = fmt.Errorf(\"failed to create gzip reader for obfuscator wasm: %w\", err)\n\t\t\treturn\n\t\t}\n\t\tdefer zr.Close()\n\n\t\tobfuscatorWasm, err = io.ReadAll(zr)\n\t\tif err != nil {\n\t\t\tobfuscatorWasmErr = fmt.Errorf(\"failed to decompress obfuscator wasm: %w\", err)\n\t\t\treturn\n\t\t}\n\t})\n\n\tif obfuscatorWasmErr != nil {\n\t\treturn nil, obfuscatorWasmErr\n\t}\n\n\tcompiledMod, err := r.CompileModule(ctx, obfuscatorWasm)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to compile obfuscator wasm module: %w\", err)\n\t}\n\n\treturn compiledMod, nil\n}\n\n// compilerSupported mimics the check performed by wazero for SSE4.1\n// We cannot rely in wazero on the wazero check, as it is used to choose whether to use the compiler or interpreter mode\n// If we force the compiler mode, and it's not supported, we will crash with SIGILL on the 1st instruction.\n// Compiler mode is required as interpreter mode is way too slow for the obfuscation (measured as being at least 60 times slower)\nfunc compilerSupported() error {\n\tswitch runtime.GOARCH {\n\tcase \"arm64\":\n\t\treturn nil\n\tcase \"amd64\":\n\t\tif !cpu.X86.HasSSE41 {\n\t\t\treturn errors.New(\"CPU lacks SSE4.1\")\n\t\t}\n","sourceCodeStart":317,"sourceCodeEnd":353,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/appsec/challenge/challenge.go#L317-L353","documentation":"compileObfuscatorModule wraps wazero's CompileModule failure with this message. The WASM bytes decompressed fine, but wazero could not compile the module (invalid bytecode, unsupported features, or a runtime/compiler problem). Called once at startup by NewChallengeRuntime.","triggerScenarios":"NewChallengeRuntime -> compileObfuscatorModule -> r.CompileModule returns an error: invalid or unsupported WASM module in obfuscatorWasm, or wazero compiler bug/incompatibility.","commonSituations":"Custom builds shipping a wrong or outdated obfuscator.wasm; wazero version incompatibilities; exotic CPU/arch where the compiler backend misbehaves.","solutions":["Rebuild from a clean checkout so the correct embedded obfuscator wasm ships (make build).","Check the wrapped %w error for the specific wazero validation message.","Pin/upgrade the wazero dependency version to one known to work with this crowdsec release (only if instructed by maintainers).","Report upstream if it reproduces on an untouched build."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// Validate the wasm in a test against the same wazero version\n_, err := r.CompileModule(ctx, obfuscatorWasm)\nif err != nil { t.Fatalf(\"obfuscator wasm invalid: %v\", err) }","typeGuard":null,"tryCatchPattern":"compiledMod, err := r.CompileModule(ctx, obfuscatorWasm)\nif err != nil { return nil, fmt.Errorf(\"failed to compile obfuscator wasm module: %w\", err) } // log the wrapped wazero message","preventionTips":["Build only from clean source; avoid forks that swap the wasm asset","Keep the wazero dependency at the version pinned by go.mod","Surface the wrapped error message, not just the wrapper, in your monitoring"],"tags":["go","wasm","wazero","startup"],"backgroundTag":"module-init-failed","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}