{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "fastmcp"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.14.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": true,
    "github_reviewed_at": "2025-12-26T23:20:50Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "There was a recent CVE report on MCP: https://nvd.nist.gov/vuln/detail/CVE-2025-66416. \n\nFastMCP does not use any of the affected components of the MCP SDK directly. However, FastMCP versions prior to 2.14.0 did allow MCP SDK versions \u003c1.23 that were vulnerable to CVE-2025-66416. Users should upgrade to FastMCP 2.14.0 or later.",
  "id": "GHSA-rcfx-77hg-w2wv",
  "modified": "2025-12-26T23:20:50Z",
  "published": "2025-12-26T23:20:50Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/jlowin/fastmcp/security/advisories/GHSA-rcfx-77hg-w2wv"
    },
    {
      "type": "WEB",
      "url": "https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-9h52-p55h-vw2f"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66416"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/jlowin/fastmcp"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [],
  "summary": "FastMCP updated to MCP 1.23+ due to CVE-2025-66416"
}