Repository navigation
Bump FastAPI/Starlette for PYSEC-2026-161 #5812
Description
The web and lsp extras exact-pin fastapi==0.120.1, which transitively pulls in starlette 0.49.3 (via FastAPI 0.120.1's starlette<0.50,>=0.40.0). starlette 0.49.3 is affected by PYSEC-2026-161 / GHSA-86qp-5c8j-p5mr — missing Host header validation poisons request.url.path, bypassing path-based security checks. Fixed in starlette 1.0.1.
Because the FastAPI pin is ==, downstream uv lock --upgrade cannot pull the patched starlette. FastAPI 0.136.3 (latest) only requires starlette>=0.46.0 with no upper cap, so bumping the pin unblocks the fix.
References:
- PYSEC-2026-161 advisory: GHSA-86qp-5c8j-p5mr
- Previous similar bump: Bump Starlette/FastAPI for CVE-2024-47874 #3392
Activity
denisephie commentedon Jun 13, 2026
I'd like to fix this, planning to bump the fastapi pin from ==0.120.1 to >=0.136.3 in pyproject.toml. Opened a PR for this: #5838
hongha912 commentedon Aug 18, 2026
Seems like @denisephie is not responding to feedback on #5838 so I'm adding a new fix #5958.