Developer Reports 5 FastAPI Vulnerabilities; 4 Remain Unpatched, One Fixed in 3 Days

A developer using FastAPI in production conducted a security review in July 2025, discovering five potential vulnerabilities and reporting all of them privately via GitHub's vulnerability reporting channel on 26 July. Within three days, project maintainer tiangolo independently authored and merged a bug fix for one of the reported issues — a flaw in the frontend() helper that silently discarded authentication headers and cookies set by dependencies. On 11 August, all five reports were closed without published advisories, consistent with the project's long-standing practice of treating security issues as ordinary bugs rather than formal vulnerabilities. FastAPI's entire public advisory history contains only two CVEs, one for a defect in its own code dating back to June 2021 and one inherited from a dependency. The developer is publishing a detailed series covering each finding, including reproductions and code references, describing the outcome as 'the system working' despite the lack of formal acknowledgment.