#3901 swamp-club.com/cve/tailworm states two things its sources do not say: finding 5's memory growth and no exploitation in the wild

What is wrong

The /cve/tailworm page (#3895, PR #1410) has two lines its sources do not support. The issue's own scope was to state only published facts, each with its date.

1. No exploitation in the wild. The lead says: None has been reported in the wild. No source says this. The tailworm.com report says nothing about exploitation outside its lab; its only statement is that all findings were verified by reproduction in a lab environment. The extension README's wording (reproduced in a lab, not seen in the wild) is our own copy, not a source.
2. Finding 5 overstates the report. The findings table row for finding 5 says one session grows root tailscaled's memory until it is killed, and it keeps growing after the session ends. The report says: ~536 MB allocated in 7 s, persisting >100 s after disconnect. The memory persists; the report does not say it keeps growing.

Neither line changes what readers should do: the SSH policy advice, the headscale warning and the commands are correct.

Fix

• Replace the in-the-wild sentence with: The report describes no exploitation outside its lab.
• Change the finding 5 row to: One session drove root tailscaled to about 536 MB in 7 s, and the memory stayed allocated more than 100 s after disconnect.
• Update routes/cve/tailworm.tsx and the matching assertion in tests/routes/cve_tailworm_test.ts.
• Check the extension README's not-seen-in-the-wild wording (swamp-extensions cve/tailworm) for the same problem.

Checked and correct

TS-2026-004 and TS-2026-005 are both fixed in 1.98.9 (Tailscale security bulletins, June 3 2026), as the page says.