FastMCP versions from 2.12.3 up to but not including 2.14.0 allow usage of MCP SDK versions prior to 1.23, which are vulnerable to CVE-2025-66416. FastMCP itself does not directly use the vulnerable MCP SDK components. Upgrading to FastMCP 2.14.0 or later mitigates exposure to this vulnerability.