FastMCP updated to MCP 1.23+ due to CVE-2025-66416
Affects fastmcpSource GCVE Database
Mentioned vulnerabilities
Rated by Threat Radar
- Patch
- Available – fixed in 2.14.0
Data as of 30 Oct 2026, 07:30 UTC
What to do
Upgrade fastmcp to 2.14.0.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
Homebrewfastmcppkg:brew/fastmcpOther threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Upgrade FastMCP to version 2.14.0 or later, which enforces usage of MCP SDK 1.23 or newer, eliminating exposure to the CVE-2025-66416 vulnerability. Since a patch is available, applying this upgrade is the recommended remediation.
Description
FastMCP versions from 2.12.3 up to but not including 2.14.0 allow usage of MCP SDK versions prior to 1.23, which are vulnerable to CVE-2025-66416. FastMCP itself does not directly use the vulnerable MCP SDK components. Upgrading to FastMCP 2.14.0 or later mitigates exposure to this vulnerability.