diff --git a/pkgs/by-name/wa/wasm3/package.nix b/pkgs/by-name/wa/wasm3/package.nix
deleted file mode 100644
index 7342011a21aa..000000000000
--- a/pkgs/by-name/wa/wasm3/package.nix
+++ /dev/null
@@ -1,51 +0,0 @@
-{
-  lib,
-  stdenv,
-  cmake,
-  fetchFromGitHub,
-}:
-
-stdenv.mkDerivation rec {
-  pname = "wasm3";
-  version = "0.5.0";
-
-  src = fetchFromGitHub {
-    owner = "wasm3";
-    repo = "wasm3";
-    rev = "v${version}";
-    sha256 = "07zzmk776j8ydyxhrnnjiscbhhmz182a62r6aix6kfk5kq2cwia2";
-  };
-
-  nativeBuildInputs = [ cmake ];
-
-  cmakeFlags = [
-    "-DBUILD_WASI=simple"
-  ];
-
-  installPhase = ''
-    runHook preInstall
-    install -Dm755 wasm3 -t $out/bin
-    runHook postInstall
-  '';
-
-  meta = {
-    homepage = "https://github.com/wasm3/wasm3";
-    description = "Fastest WebAssembly interpreter, and the most universal runtime";
-    platforms = lib.platforms.all;
-    maintainers = with lib.maintainers; [ malbarbo ];
-    license = lib.licenses.mit;
-    knownVulnerabilities = [
-      # wasm3 expects all wasm code to be pre-validated, any users
-      # should be aware that running unvalidated wasm will potentially
-      # lead to RCE until upstream have added a builtin validator
-      "CVE-2022-39974"
-      "CVE-2022-34529"
-      "CVE-2022-28990"
-      "CVE-2022-28966"
-      "CVE-2021-45947"
-      "CVE-2021-45946"
-      "CVE-2021-45929"
-      "CVE-2021-38592"
-    ];
-  };
-}
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index cc7501f1f5bb..7c8a63fa094a 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -2250,6 +2250,7 @@ mapAliases {
   warsow = throw "'warsow' has been removed as it is unmaintained and is broken"; # Added 2025-10-09
   warsow-engine = throw "'warsow-engine' has been removed as it is unmaintained and is broken"; # Added 2025-10-09
   wasistlos = throw "'wasistlos' has been removed because it was unmaintained and archived upstream. Consider using 'karere' instead"; # Added 2026-04-13
+  wasm3 = throw "'wasm3' has been removed as it is unmaintained upstream and has many known vulnerabilities"; # Added 2026-06-03
   wasm-bindgen-cli = wasm-bindgen-cli_0_2_121;
   wasm-strip = throw "'wasm-strip' has been removed due to upstream deprecation. Use 'wabt' instead."; # Added 2025-11-06
   wavebox = throw "'wavebox' has been removed due to lack of maintenance in nixpkgs"; # Added 2025-06-24