crowdsecurity/crowdsec · critical

wasm compiler mode unavailable: %w

Error message

wasm compiler mode unavailable: %w

What it means

newWazeroRuntime wraps any compilerSupported() failure with this message, meaning the wazero compiler backend cannot run here: unsupported GOARCH, or amd64 CPU lacking SSE4.1. AppSec challenge runtime initialization aborts because compiler mode is requested.

Source

Thrown at pkg/appsec/challenge/challenge.go:362

// Compiler mode is required as interpreter mode is way too slow for the obfuscation (measured as being at least 60 times slower)
func compilerSupported() error {
	switch runtime.GOARCH {
	case "arm64":
		return nil
	case "amd64":
		if !cpu.X86.HasSSE41 {
			return errors.New("CPU lacks SSE4.1")
		}

		return nil
	default:
		return fmt.Errorf("GOARCH %s has no wasm compiler backend", runtime.GOARCH)
	}
}

func newWazeroRuntime(ctx context.Context) (wazero.Runtime, error) {
	if err := compilerSupported(); err != nil {
		return nil, fmt.Errorf("wasm compiler mode unavailable: %w", err)
	}

	var r wazero.Runtime
	var err error

	func() {
		// wazero checks for executable memory, and panics if it cannot allocat it.
		// Catch the panic and return an error instead, so we can provide a more helpful message to the user.
		defer func() {
			if rec := recover(); rec != nil {
				err = fmt.Errorf("failed to create wasm runtime in compiler mode: %v "+
					"(the kernel likely denied an executable memory mapping: check W^X hardening, seccomp or SELinux policy)", rec)
			}
		}()

		r = wazero.NewRuntimeWithConfig(ctx, wazero.NewRuntimeConfigCompiler())
	}()

View on GitHub (pinned to 909b515798)

Solutions

1. Run on hardware supporting SSE4.1 (check: grep -q sse4_1 /proc/cpuinfo) or move to arm64.
2. Rebuild for a supported GOARCH (amd64/arm64).
3. If running in a VM/emulator, enable a CPU model that exposes SSE4.1 (e.g. QEMU -cpu host or Nehalem+).
4. Ask maintainers about an interpreter-mode (wazero.NewRuntimeConfigInterpreter) fallback for unsupported hosts.

// amd64: require SSE4.1 before installing
if runtime.GOOS == "linux" && runtime.GOARCH == "amd64" && !cpu.X86.HasSSE41 {
    fmt.Println("CPU lacks SSE4.1: appsec challenge runtime unavailable")
}

When it happens

Trigger: NewChallengeRuntime -> newWazeroRuntime -> compilerSupported returns an error (GOARCH without a wazero compiler backend, or x86-64 CPU without SSE4.1).

Common situations: Old x86-64 CPUs/pre-2009 virtual hosts without SSE4.1; 32-bit or other non-amd64/arm64 builds; VMs or emulators (e.g. QEMU without SSE4.1 passthrough).

Understand the failure class

Background: "unsupported platform" / "not supported on this platform" errors: what they mean and how to fix them — this error's family across 47 libraries.

Related errors

• failed to compile obfuscator wasm module: %w
• failed to create wasm runtime in compiler mode: %v (the kern
• failed to instantiate WASI: %w
• failed to create gzip reader for obfuscator wasm: %w
• failed to decompress obfuscator wasm: %w

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/679df28ef2d52589. Report an issue: GitHub.