Pydantic AI fixes high-severity bug: nested JSON can bloat 100x in web fetch
caolonghua · x · 2026-11-05
Pydantic AI v2.66.0 patches a high-severity issue in its local web-fetch fallback: webfetchtool re-indents JSON responses on the event loop before applying the returned-content limit, so a deeply nested document within the download limit could expand hundreds of times, hog memory, and stall the process. Affects apps where an attacker can influence fetched URLs; provider-native web fetching is unaffected. Fixed in v2.66.0 and v1.107.10 of both pydantic-ai and pydantic-ai-slim.