{"slug": "node-fetch-on-latest-node-update-broken", "title": "Node-Fetch on latest Node Update broken", "summary": "Node.js v24.17.0 introduced a regression in the http subsystem that causes keep-alive requests to fail with ERR_STREAM_PREMATURE_CLOSE, breaking gaxios and node-fetch used by Google API clients. The issue was bisected to the v24.17.0 release and affects platforms including Linux and Windows, with no workaround other than pinning to v24.16.0.", "body_md": "-\n-\n[Notifications](/login?return_to=%2Fnodejs%2Fnode)You must be signed in to change notification settings -\n[Fork 35.7k](/login?return_to=%2Fnodejs%2Fnode)\n\n# http: ERR_STREAM_PREMATURE_CLOSE (\"Premature close\") regression on keep-alive requests, bisects to v24.17.0 — breaks gaxios/node-fetch (Google API clients) #63989\n\n## Description\n\n### Version\n\nv24.17.0\n\n### Platform\n\n```\nReproduced on Linux x64 (Cloud Run / gVisor, Debian 12). A second, independent\n  report is on Windows 11 x64 (see firebase-tools #10681 below), so this appears\n  to be platform-independent and runtime-version-driven.\n```\n\n### Subsystem\n\nhttp / http.Agent (keep-alive socket reuse)\n\n### What steps will reproduce the bug?\n\nI don't yet have a reduced standalone repro, but the behavior change is sharply bisected and reproduces across two independent code paths plus a second reporter:\n\nBoth paths run through `gaxios@6.7.1`\n\n→ `node-fetch@2.7.0`\n\n→ core `node:http`\n\nwith a keep-alive `http.Agent`\n\n, making requests to `*.googleapis.com`\n\n:\n\n`googleapis@144`\n\nDrive`files.list`\n\n(background polling loop, long-lived process)`@google-cloud/storage@7.14.0`\n\nv4 signed-URL signing via`google-auth-library@9.15.0`\n\n`GoogleAuth.signBlob`\n\n→`https://iamcredentials.googleapis.com/.../:signBlob`\n\nBoth began failing immediately on a deploy whose **only** material change was the Node runtime moving from **24.16.0 → 24.17.0** (a floating `node:24-slim`\n\nbase image picked up the same-day 24.17.0 release). No dependency versions changed. **Pinning the image back to node:24.16.0-slim fully resolves both.**\n\nA likely minimal-repro shape (from the related node-fetch issue below) is a keep-alive `https.Agent`\n\n({ keepAlive: true, maxSockets: N }) issuing more than N sequential/concurrent requests to a chunked or gzip-encoded HTTPS endpoint. I'm happy to invest in a self-contained reproduction if that would help — wanted to file the bisect promptly given the blast radius.\n\n### How often does it reproduce? Is there a required condition?\n\nReliably under load on 24.17.0; never on 24.16.0. Appears tied to keep-alive socket reuse — the failure is a premature close on a *reused* pooled socket.\n\n### What is the expected behavior? Why is that the expected behavior?\n\nKeep-alive pooled HTTP requests that complete normally on 24.16.0 should continue to complete on 24.17.0 without the response body being reported as prematurely closed.\n\n### What do you see instead?\n\nFetchError: Invalid response body while trying to fetch [https://www.googleapis.com/drive/v3/files](https://www.googleapis.com/drive/v3/files)?...: Premature close code: ERR_STREAM_PREMATURE_CLOSE\n\nand on the signing path:\n\n```\n  SigningError: Invalid response body while trying to fetch\n  https://iamcredentials.googleapis.com/.../:signBlob: Premature close\n    gaxios@6.7.1/gaxios.ts:157\n    google-auth-library@9.15.0 GoogleAuth.signBlob\n```\n\n### Additional information\n\n**Suspected cause:** the 24.17.0 changelog entry*\"http: fix response queue poisoning in*(plus the TLS/SNI changes) — anything altering keep-alive socket reuse timing is a candidate.`http.Agent`\n\n\"**Independent same-day report (different OS, different Google tool):**[Firebase login issue firebase/firebase-tools#10681](https://github.com/firebase/firebase-tools/issues/10681)—`FetchError ... Premature close`\n\non`https://accounts.google.com/o/oauth2/token`\n\n, Node v24.17.0, Windows 11.**Latent library-side bug being exposed:**[Malformed chunked response detector creates false-positive ‘premature close’ errors when HTTP Agent involved node-fetch/node-fetch#1767](https://github.com/node-fetch/node-fetch/issues/1767)(\"Malformed chunked response detector creates false-positive 'premature close' errors when HTTP Agent involved\"). It's plausible 24.17.0 is*correctly*surfacing a long-standing node-fetch defect rather than itself being wrong — but since the observable trigger is the runtime bump and node-fetch@2 is effectively unmaintained, confirmation of whether this is intended/expected behavior at the`http.Agent`\n\nlevel (vs. a fix-forward in 24.17.x) would help a large slice of the Google-API-client ecosystem decide how to respond.- The whole googleapis /\n[@Google-Cloud](https://github.com/Google-Cloud)/ google-auth-library stack still depends transitively on`gaxios@6`\n\n→`node-fetch@2`\n\n, so the affected surface is broad.\n\n## Metadata\n\n## Metadata\n\n### Assignees\n\n### Labels\n\n### Type\n\n### Fields\n\n[Give feedback](https://github.com/orgs/community/discussions/189141)", "url": "https://wpnews.pro/news/node-fetch-on-latest-node-update-broken", "canonical_source": "https://github.com/nodejs/node/issues/63989", "published_at": "2026-06-19 09:58:42+00:00", "updated_at": "2026-06-19 10:38:01.601592+00:00", "lang": "en", "topics": ["developer-tools"], "entities": ["Node.js", "gaxios", "node-fetch", "Google", "Firebase"], "alternates": {"html": "https://wpnews.pro/news/node-fetch-on-latest-node-update-broken", "markdown": "https://wpnews.pro/news/node-fetch-on-latest-node-update-broken.md", "text": "https://wpnews.pro/news/node-fetch-on-latest-node-update-broken.txt", "jsonld": "https://wpnews.pro/news/node-fetch-on-latest-node-update-broken.jsonld"}}