What causes "failed to compile obfuscator wasm module: %w" in crowdsecurity/crowdsec?

Rebuild from a clean checkout so the correct embedded obfuscator wasm ships (make build).

failed to compile obfuscator wasm module: %w

Error message

failed to compile obfuscator wasm module: %w

What it means

compileObfuscatorModule wraps wazero's CompileModule failure with this message. The WASM bytes decompressed fine, but wazero could not compile the module (invalid bytecode, unsupported features, or a runtime/compiler problem). Called once at startup by NewChallengeRuntime.

Source

Thrown at pkg/appsec/challenge/challenge.go:335

			obfuscatorWasmErr = fmt.Errorf("failed to create gzip reader for obfuscator wasm: %w", err)
			return
		}
		defer zr.Close()

		obfuscatorWasm, err = io.ReadAll(zr)
		if err != nil {
			obfuscatorWasmErr = fmt.Errorf("failed to decompress obfuscator wasm: %w", err)
			return
		}
	})

	if obfuscatorWasmErr != nil {
		return nil, obfuscatorWasmErr
	}

	compiledMod, err := r.CompileModule(ctx, obfuscatorWasm)
	if err != nil {
		return nil, fmt.Errorf("failed to compile obfuscator wasm module: %w", err)
	}

	return compiledMod, nil
}

// compilerSupported mimics the check performed by wazero for SSE4.1
// We cannot rely in wazero on the wazero check, as it is used to choose whether to use the compiler or interpreter mode
// If we force the compiler mode, and it's not supported, we will crash with SIGILL on the 1st instruction.
// Compiler mode is required as interpreter mode is way too slow for the obfuscation (measured as being at least 60 times slower)
func compilerSupported() error {
	switch runtime.GOARCH {
	case "arm64":
		return nil
	case "amd64":
		if !cpu.X86.HasSSE41 {
			return errors.New("CPU lacks SSE4.1")
		}

View on GitHub (pinned to 909b515798)

Solutions

Rebuild from a clean checkout so the correct embedded obfuscator wasm ships (make build).
Check the wrapped %w error for the specific wazero validation message.
Pin/upgrade the wazero dependency version to one known to work with this crowdsec release (only if instructed by maintainers).
Report upstream if it reproduces on an untouched build.

Defensive patterns

Strategy: try-catch

Validate before calling

// Validate the wasm in a test against the same wazero version
_, err := r.CompileModule(ctx, obfuscatorWasm)
if err != nil { t.Fatalf("obfuscator wasm invalid: %v", err) }

Try / catch

compiledMod, err := r.CompileModule(ctx, obfuscatorWasm)
if err != nil { return nil, fmt.Errorf("failed to compile obfuscator wasm module: %w", err) } // log the wrapped wazero message

Prevention

Build only from clean source; avoid forks that swap the wasm asset
Keep the wazero dependency at the version pinned by go.mod
Surface the wrapped error message, not just the wrapper, in your monitoring

When it happens

Trigger: NewChallengeRuntime -> compileObfuscatorModule -> r.CompileModule returns an error: invalid or unsupported WASM module in obfuscatorWasm, or wazero compiler bug/incompatibility.

Common situations: Custom builds shipping a wrong or outdated obfuscator.wasm; wazero version incompatibilities; exotic CPU/arch where the compiler backend misbehaves.

Related errors

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/faa409f0da1748e0. Report an issue: GitHub.