Advisoriesby IbisfastmcpGHSA-rcfx-77hg-w2wv
FastMCP updated to MCP 1.23+ due to CVE-2025-66416
Fix: upgrade to 2.14.0 or later
There was a recent CVE report on MCP: https://nvd.nist.gov/vuln/detail/CVE-2025-66416.
FastMCP does not use any of the affected components of the MCP SDK directly. However, FastMCP versions prior to 2.14.0 did allow MCP SDK versions <1.23 that were vulnerable to CVE-2025-66416. Users should upgrade to FastMCP 2.14.0 or later.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| fastmcp PyPI | < 2.14.0 | 2.14.0 |
Details and references
More fastmcp advisories
All fastmcp
FastMCP: Missing Consent Verification in OAuth Proxy Callback Facilitates Confused Deputy VulnerabilitiesCVE-2026-27124fixed in 3.2.0FastMCP has a Command Injection vulnerability - Gemini CLICVE-2025-64340fixed in 3.2.0FastMCP OAuth Proxy token reuse across MCP serversCVE-2025-69196fixed in 2.14.2FastMCP vulnerable to windows command injection in FastMCP Cursor installer via server_nameCVE-2025-62801fixed in 2.13.0FastMCP vulnerable to reflected XSS in client's callback pageCVE-2025-62800fixed in 2.13.0FastMCP Auth Integration Allows for Confused Deputy Account TakeoverGHSA-c2jp-c369-7pvxfixed in 2.13.0