GHSA-rcfx-77hg-w2wv: FastMCP updated to MCP 1.23+ due to CVE-2025-66416

December 26, 2025

There was a recent CVE report on MCP: https://nvd.nist.gov/vuln/detail/CVE-2025-66416.

FastMCP does not use any of the affected components of the MCP SDK directly. However, FastMCP versions prior to 2.14.0 did allow MCP SDK versions <1.23 that were vulnerable to CVE-2025-66416. Users should upgrade to FastMCP 2.14.0 or later.

References

github.com/advisories/GHSA-rcfx-77hg-w2wv
github.com/jlowin/fastmcp
github.com/jlowin/fastmcp/security/advisories/GHSA-rcfx-77hg-w2wv
github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-9h52-p55h-vw2f
nvd.nist.gov/vuln/detail/CVE-2025-66416

Code Behaviors & Features

Detect and mitigate GHSA-rcfx-77hg-w2wv with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →