Two critical RCEs landed this week alongside a meaningful protocol revision in the MCP ecosystem—the kind of week where you're patching in parallel with upgrading. The security items aren't optional reading; if you're running Rails or Nuxt in production, those sections should override your normal triage queue.
mcp-handler 2.0 ships stateless protocol support
mcp-handler@2.0.0 implements the 2026-07-28 MCP spec with a Streamable HTTP transport that requires no session state—no Redis, no sticky sessions, no external coordination layer. Existing Streamable HTTP clients continue working without modification while new clients get the stateless path automatically.
The practical impact is significant for serverless deployments. The previous model assumed durable connections and server-side session tracking, which mapped poorly onto Lambda, Workers, or any ephemeral compute environment. This release makes MCP a first-class citizen on those platforms without workarounds.
Breaking changes to understand before upgrading: HTTP+SSE transport is fully removed. Requests to /sse and /message return 410 Gone. The package also migrates from @modelcontextprotocol/sdk to @modelcontextprotocol/server, and requires Node.js 20+ and zod@^4.
