GHSA-rcfx-77hg-w2wv json
FastMCP updated to MCP 1.23+ due to CVE-2025-66416
published 10mo ago modified 10mo ago
- cvss
- —
- not scored
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- —
- no score, EPSS covers CVEs only
- public exploits
- 0
- none known
Summary
There was a recent CVE report on MCP: https://nvd.nist.gov/vuln/detail/CVE-2025-66416.
FastMCP does not use any of the affected components of the MCP SDK directly. However, FastMCP versions prior to 2.14.0 did allow MCP SDK versions <1.23 that were vulnerable to CVE-2025-66416. Users should upgrade to FastMCP 2.14.0 or later.
Patch / fix
- pypi fastmcp 2.14.0
Is GHSA-rcfx-77hg-w2wv in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerAffected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | fastmcp | <2.14.0 |
2.14.0 |
References
-
github.com
/jlowin/fastmcp/security/advisories/GHSA-rcfx-77hg-w2wv
web
-
github.com
/modelcontextprotocol/python-sdk/security/advisories/GHSA-9h52-p55h-vw2f
web
-
nvd.nist.gov
/vuln/detail/CVE-2025-66416
advisory
-
github.com
/jlowin/fastmcp
package
-
github.com
/PrefectHQ/fastmcp/security/advisories/GHSA-rcfx-77hg-w2wv
advisory
Sources
- GitHub Advisory GHSA-rcfx-77hg-w2wv
- Maintainer advisory GHSA-rcfx-77hg-w2wv
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
The maintainers of PrefectHQ/fastmcp published their own advisory on GitHub. Reviewed sources take precedence over it.