I think this is probably the real reason such encodings are considered valid. The webassembly spec is explicit about allowing valid over-wide encodings: https:

I think this is probably the real reason such encodings are considered valid. The webassembly spec is explicit about allowing valid over-wide encodings: https://webassembly.github.io/spec/core/binary/values.html https://webassembly.github.io/spec/core/binary/values.html Maybe a robust parser would benefit from a strict mode, disallowing over-wide encoding.