GHSA-rcfx-77hg-w2wv

Details

There was a recent CVE report on MCP: https://nvd.nist.gov/vuln/detail/CVE-2025-66416.

FastMCP does not use any of the affected components of the MCP SDK directly. However, FastMCP versions prior to 2.14.0 did allow MCP SDK versions <1.23 that were vulnerable to CVE-2025-66416. Users should upgrade to FastMCP 2.14.0 or later.

Affected Packages

fastmcp

PyPI

Fixed in:

2.14.0

References

ADVISORYhttps://github.com/advisories/GHSA-rcfx-77hg-w2wv PACKAGEhttps://github.com/jlowin/fastmcp WEBhttps://github.com/jlowin/fastmcp/security/advisories/GHSA-rcfx-77hg-w2wv WEBhttps://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-9h52-p55h-vw2f ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2025-66416

GHSA-rcfx-77hg-w2wv

Details

Affected Packages

References

Ecosystems

Timeline