WebAssembly: Refused to compile or instantiate WebAssembly module

Quick fix

Read the commands before running them. Anything that restarts a service, deletes data or changes permissions should be tried on a non-production system first.

# What policy is the page actually served with?
curl -sI https://example.com/ | grep -i content-security-policy
# also check for a <meta http-equiv="Content-Security-Policy"> in the HTML:
# if both exist, each one must allow Wasm

# Allow Wasm compilation without allowing JavaScript eval
Content-Security-Policy: script-src 'self' 'wasm-unsafe-eval'

# nginx
add_header Content-Security-Policy "script-src 'self' 'wasm-unsafe-eval'" always;

# Browser extension, Manifest V3 (manifest.json)
"content_security_policy": {
  "extension_pages": "script-src 'self' 'wasm-unsafe-eval'; object-src 'self'"
}

How to diagnose WebAssembly errors

WebAssembly errors are precise about the layer that failed. A CompileError means the bytes are not a valid module: most often the file was served with the wrong MIME type, or an HTML error page was fetched instead of the .wasm file. A RuntimeError: memory access out of bounds means the module read or wrote outside its linear memory, which in a language like C or Rust is a genuine memory-safety bug caught by the sandbox.

If the quick fix above does not resolve it, work through these steps. They apply to this whole class of error, not just to this one message, which is usually what saves the time.

1. Check what the server actually returned. The wasm file must be served as application/wasm for streaming compilation, and a 404 HTML page produces a misleading magic-number error.
2. Validate the module offline with wasm-validate and inspect it with wasm-objdump -x from the WABT toolkit.
3. For out-of-bounds errors, rebuild with sanitizers or debug assertions in the source language. The wasm runtime cannot tell you which source line was responsible without DWARF info.
4. Confirm imports match: every function the module imports must be supplied by the host with the exact name and signature, or instantiation fails.
5. Build with debug symbols and use the browser's DWARF support to step through original source rather than raw wasm.

Tools worth reaching for

• wasm-validate / wasm-objdump (WABT)
• browser DWARF debugging
• wasmtime --invoke
• curl -I (check MIME type)

Authoritative references

Primary documentation for this error, worth reading before applying any fix in production.

📖 developer.mozilla.org 📖 developer.chrome.com

Related WebAssembly errors

• Emscripten: Cannot call unknown function (make sure it is exported)ccall and cwrap look the symbol up in the module at runtime, and the linker had already…
• Emscripten: RuntimeError: Aborted(). Build with -sASSERTIONS for more info.Emscripten's runtime hit a fatal condition and called abort(), but release builds leave out…
• Rust: Could not find specification for target "wasm32-wasi"Rust renamed the wasm32-wasi target to wasm32-wasip1 to make room for WASI 0.2, then removed…
• wasm-bindgen: closure invoked after being droppedA Rust closure handed to JavaScript lives only as long as its Closure value, and letting that…
• wasm-bindgen: recursive use of an object detectedA Rust method holding a mutable borrow of a struct called into JavaScript, and that…
• wasm-pack: crate-type must be cdylib to compile to wasm32-unknown-unknownA Rust library defaults to the rlib crate type, which cannot be linked into a WebAssembly…
• WebAssembly: Cannot enlarge memory arraysThe module asked for more linear memory than it was built to have. Emscripten fixes the heap…
• WebAssembly: CompileError - invalid magic / sectionThe .wasm file is not valid WebAssembly bytes. Often the server returned an HTML error page…

See all 17 WebAssembly errors →

Browse other categories

• HTTP 494xx client errors, 5xx server errors, redirects, headers and protocol problems.
• JavaScript 42npm resolution, async pitfalls, hydration, memory limits and runtime type…
• Database 41Connections, deadlocks, constraints, replication and memory limits.
• AI 35Rate limits, context windows, GPU memory and model-serving failures.
• Network 35Refused connections, timeouts, resets, MTU problems and port exhaustion.
• Python 35Imports, virtual environments, encoding, concurrency and dependency conflicts.
• Kubernetes 34CrashLoopBackOff, ImagePullBackOff, OOMKilled, RBAC, scheduling and storage.
• Docker 27Daemon connectivity, disk space, image pulls, ports and architecture mismatches.
• System 26Disk space, systemd units, file descriptors, OOM killer and scheduled jobs.
• Cloud 25IAM permissions, quotas, service limits and credential failures.
• Security 25JWT validation, CSRF, OAuth grants, SELinux, SSH host keys and CSP.
• TLS 24Untrusted authorities, expiry, hostname mismatch, chains and cipher negotiation.

Something missing or wrong?

This entry is maintained by hand. If the fix is out of date, incomplete, or you have a better one, email a correction and it will be reviewed.