FastMCP updated to MCP 1.23+ due to CVE-2025-66416

ALTOGHSA-rcfx-77hg-w2wv · Published 26/12/2025 · updated 26/12/2025

In breve

GHSA-rcfx-77hg-w2wv è una vulnerabilità ALTO che riguarda fastmcp.
Correzione: aggiornare a 2.14.0 o successiva.

Package	Affected versions	Patched versions
fastmcp PyPI	`< 2.14.0`	`2.14.0`

Description

There was a recent CVE report on MCP: https://nvd.nist.gov/vuln/detail/CVE-2025-66416.

FastMCP does not use any of the affected components of the MCP SDK directly. However, FastMCP versions prior to 2.14.0 did allow MCP SDK versions <1.23 that were vulnerable to CVE-2025-66416. Users should upgrade to FastMCP 2.14.0 or later.

References

jlowin/fastmcp security advisory · WEB
modelcontextprotocol/python-sdk security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2025-66416 · ADVISORY
jlowin/fastmcp · PACKAGE

Altre vulnerabilità di fastmcp

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free