fastmcp

v3.4.2 Feature

This release adds 1 notable feature for engineering teams evaluating rollout.

Published 1mo AI Coding Tools

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

agents fastmcp llms mcp mcp-clients mcp-servers

+3 more

mcp-tools model-context-protocol python

Affected surfaces

auth

Summary

AI summary

Allows private non‑critical JWS header parameters in JWTs while rejecting unsupported critical headers.

Changes in this release

Type	Severity	Summary	CVE
Bugfix	Medium	Allows private JWT header parameters like `cat` without rejection. Allows private JWT header parameters like `cat` without rejection. Source: llm_adapter@2026-06-06 Confidence: high	—

Full changelog

FastMCP 3.4.2 restores JWT compatibility for providers that include private, non-critical JWS header parameters. Tokens from providers like Clerk can carry header metadata such as cat without being rejected before signature and claim validation, while unsupported critical headers are still rejected.

What's Changed

Fixes 🐞

Allow private JWT headers by @jlowin in https://github.com/PrefectHQ/fastmcp/pull/4290

Docs 📚

Docs: add v3.4.1 changelog entries by @jlowin in https://github.com/PrefectHQ/fastmcp/pull/4289

Full Changelog: https://github.com/PrefectHQ/fastmcp/compare/v3.4.1...v3.4.2

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track fastmcp

Get notified when new releases ship.

About fastmcp

The fast, Pythonic way to build MCP servers and clients.

All releases →

Related context

Related tools

Earlier breaking changes

v3.4.0 Proxy initialize now forwards upstream initialization, failing loudly on errors.