Provenance Record

Dense, well-structured Briefing (706 words, within 300-800). Each advisory is described from its own page; Overview, What We Know, What We Don't Know and Takeaway sections are clear.

Read all 7 gunzipped snapshots (source-0..6.html.gz), all HTTP 200, suspicious_patterns null for every source (nothing to review). source-0 (GHSA-32h6-97mm-8q3c): Critical, CVSS 9.3, vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H, 'No known CVE', published Oct 2, 2026 by alexcrichton, affected '>= 39.0.0, < 48.0.4, >= 49.0.0, < 49.0.2', patched 48.0.4 and 49.0.2, CWE-20 and CWE-121, credits smaeljaish771 (Reporter) and KeenSecurityLab (Sponsor); text 'write up to ~16KB of arbitrary data of its choosing to the process's native stack' and 'it's still recommended for embedders to treat this as if it's a arbitrary code execution sandbox escape vulnerability' are verbatim and correctly attributed to the advisory; wasmparser v0.259.0 typo root cause and workarounds (disable component-model-async, wasmparser v1.260.0 or later) confirmed. source-1 (GHSA-j366-h8gg-77pm): Moderate 4.0, CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, no CVE, Oct 2 2026, affected '< 36.0.17, >= 37.0.0, < 48.0.4, >= 49.0.0, < 49.0.2', patched 36.0.17, 48.0.4, 49.0.2, credits smaeljaish771/KeenSecurityLab, wasmtime CLI affected because WASI preview 0 on by default, workaround -Spreview0=n; the fuel-bypass description matches. source-2 (GHSA-hw8m-q44c-ggrf): Moderate 5.7, CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H, no CVE, Oct 2 2026, affected >= 47.0.0 ranges, patched 48.0.4/49.0.2, no credits listed; quote 'Both GC and exceptions are on-by-default in Wasmtime v47 and above.' verbatim. source-3 (GHSA-cfhf-m2cr-62wj): Moderate 5.9, CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N, no CVE, Oct 2 2026, patched 48.0.4/49.0.2, no credits; 'implemented to be resilient to corruption but this is nevertheless a bug to fix' verbatim; workaround claim matches. source-4 (v49.0.2, released 2026-10-02): lists exactly eight GHSA items (j366, gqmc-89g8-p25r, 96f6-r43r-8c24, mr2v-56j5-cmfc, 32h6, cfhf, w4qr-p94g-mjhv, hw8m), matching 'eight advisories' and the four 'rest of batch' descriptions. source-5 (v48.0.5): contains 48.0.5 note (48.0.4 artifacts not correctly published from CI, no GitHub release for 48.0.4) and a 48.0.4 section listing the same eight, both dated 2026-10-02. source-6 (v49.0.1, 2026-09-24): four advisories (call_ref fuel spend, dynamic record lifting fuel, outgoing HTTP body memory exhaustion, out-of-range datetime panic) match.

Version numbers: the fix landed in 48.0.4 (and 49.0.2); 48.0.5 is a follow-up that repairs 48.0.4's missing CI artifacts/GitHub release. The title is therefore accurate, and the body discloses the 48.0.4/48.0.5 distinction. 'Users should take 48.0.5' is the writer's inference from the release note, mild but reasonable. CVE: every one of the four advisories says 'No known CVE'; the article states this and also notes the other four are named only from release notes. One error: the heading 'A second release in nine days' - 49.0.1 (Sep 24) to 49.0.2 (Oct 2) is eight days; filed as a correction. No exploitation-in-the-wild claim; the article correctly says advisories do not state this. April cross-reference (article 2026-04/10, 12 vulnerabilities, two critical) is accurate and the internal link form is correct.

Accurate and well sourced; every verifiable specific traces to a snapshot. One minor day-count error is covered by a corrections note, so APPROVE_WITH_CORRECTIONS.