GHSA-rcfx-77hg-w2wv | jlowin/fastmcp Security

GHSA ID: GHSA-rcfx-77hg-w2wv
Severity: high
Published: 2025-12-26T23:20:50Z
Updated: 2025-12-26T23:20:51Z

Description

There was a recent CVE report on MCP: https://nvd.nist.gov/vuln/detail/CVE-2025-66416.

FastMCP does not use any of the affected components of the MCP SDK directly. However, FastMCP versions prior to 2.14.0 did allow MCP SDK versions <1.23 that were vulnerable to CVE-2025-66416. Users should upgrade to FastMCP 2.14.0 or later.

References

https://github.com/jlowin/fastmcp/security/advisories/GHSA-rcfx-77hg-w2wv ↗
https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-9h52-p55h-vw2f ↗
https://nvd.nist.gov/vuln/detail/CVE-2025-66416 ↗
https://github.com/advisories/GHSA-rcfx-77hg-w2wv ↗

Open GitHub