FastMCP updated to MCP 1.23+ due to CVE-2025-66416

GHSA-rcfx-77hg-w2wv

Published Dec 26, 2025 · Modified Dec 26, 2025

AI SAST

Find this class of vulnerability in your own code

Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.

Explore AI SAST Explore dependency scanning →

Description

There was a recent CVE report on MCP: https://nvd.nist.gov/vuln/detail/CVE-2025-66416.

FastMCP does not use any of the affected components of the MCP SDK directly. However, FastMCP versions prior to 2.14.0 did allow MCP SDK versions <1.23 that were vulnerable to CVE-2025-66416. Users should upgrade to FastMCP 2.14.0 or later.

References

WEB https://github.com/jlowin/fastmcp/security/advisories/GHSA-rcfx-77hg-w2wv
WEB https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-9h52-p55h-vw2f
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2025-66416
PACKAGE https://github.com/jlowin/fastmcp

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes

FastMCP updated to MCP 1.23+ due to CVE-2025-66416

Description

References

More PyPI vulnerabilities

Start Securing