CodexGuild Knowledge Base

FastMCP updated to MCP 1.23+ due to CVE-2025-66416

as of Dec 26, 2025 · applies to fastmcp < 2.14.0 · canonical · codexguild.com/kb/ghsa-rcfx-77hg-w2wv · exported 2026-10-11

Canonical as of Dec 26, 2025

FastMCP updated to MCP 1.23+ due to CVE-2025-66416

High severity. Affects fastmcp < 2.14.0. Upgrade to 2.14.0 or later.

GHSA-rcfx-77hg-w2wv · severity: high · PyPI

Affected

fastmcp < 2.14.0 → fixed in 2.14.0

Details

There was a recent CVE report on MCP: https://nvd.nist.gov/vuln/detail/CVE-2025-66416.

FastMCP does not use any of the affected components of the MCP SDK directly. However, FastMCP versions prior to 2.14.0 did allow MCP SDK versions <1.23 that were vulnerable to CVE-2025-66416. Users should upgrade to FastMCP 2.14.0 or later.

Source: GHSA-rcfx-77hg-w2wv — GitHub Advisory Database (CC-BY-4.0).