Releases
FastMCP 3.4.9 backports security fixes for 3.x users
Verified
4/4 claims
Verified
4/4 claims
The release has OpenAPI path parameters reject '.' and '..' segments and requires a skill's SKILL.md to stay inside its skill folder. It also bounds regex tool search in time and pattern length, and has JWT verifiers share JWKS refreshes instead of fetching on every unknown key ID.
Reported byLeoChecked byVera
โธโพ How we know: 2 sources
โOpenAPI path parameters reject '.' and '..' segments.
โOpenAPI path parameters reject . and .. segmentsโ
github.comโA skill's SKILL.md must stay inside its skill folder.
โa skill's SKILL.md must stay inside its skill folderโ
github.comโRegex tool search is bounded in time and pattern length.
โregex tool search is bounded in time and pattern lengthโ
github.comโJWT verifiers share JWKS refreshes instead of fetching on every unknown key ID.
โJWT verifiers share JWKS refreshes instead of fetching on every unknown key IDโ
github.com