v4.16.9

punkpeye/fastmcpv4.16.9Aug 26, 2026by github-actions[bot]

AI Summary

Significantly strengthens security by tightening OAuth handling, file permissions, and input validation to protect against injection and permission issues.

Key Highlights

Escape regex metacharacters in redirect URI patterns
Protect issued scope claims from upstream passthrough
Restrict DiskStore file and directory permissions
Cap POST bodies that arrive without a Content-Length

Full Release Notes

## [4.16.9](https://github.com/punkpeye/fastmcp/compare/v4.16.8...v4.16.9) (2026-08-26)


### Bug Fixes

* **auth:** escape regex metacharacters in redirect URI patterns ([#332](https://github.com/punkpeye/fastmcp/issues/332)) ([565c2fb](https://github.com/punkpeye/fastmcp/commit/565c2fbce23c8254737f1e87fd4b8804dd1d754b))
* **auth:** protect the issued scope claim from upstream passthrough ([#336](https://github.com/punkpeye/fastmcp/issues/336)) ([aae35ce](https://github.com/punkpeye/fastmcp/commit/aae35ce3fb2f9aafcbe1018ac987c5bb17559735))
* **auth:** restrict DiskStore file and directory permissions ([#335](https://github.com/punkpeye/fastmcp/issues/335)) ([be19f87](https://github.com/punkpeye/fastmcp/commit/be19f87df1fe28f7eaba156fa38cba8ab9c699df))
* **edge:** cap a POST body that arrives without a Content-Length ([#333](https://github.com/punkpeye/fastmcp/issues/333)) ([3361d43](https://github.com/punkpeye/fastmcp/commit/3361d43eca39cd5f78a1e752c066d3ac2e94a0d3))
* **oauth:** mark token and registration responses as non-storable ([#334](https://github.com/punkpeye/fastmcp/issues/334)) ([0381f64](https://github.com/punkpeye/fastmcp/commit/0381f641ce1d8443f83e16cae328f99461904a8c))