Distillation

Date: June 24, 2026

• 🟡 (08:37) PR #64004 ("http: avoid stream listeners on idle agent sockets") confirmed MERGED into nodejs:main on Jun 20, 2026; authored by @mcollina; 1 commit (hash 0d62f61c827062070b88e5ffa50f441026b0d1a0, force-pushed from 8d8919c); signed-off by Matteo Collina hello@matteocollina.com
• 🟡 (08:37) PR #64004 root-cause description (from @mcollina): "The response-queue-poisoning guard added to idle http.Agent sockets used a public 'data' listener. That made node-fetch@2 observe socket.listenerCount('data') > 0 during response close and report false ERR_STREAM_PREMATURE_CLOSE errors."
• 🟡 (08:37) PR #64004 fix mechanism: changed idle-socket guard to use socket handle's internal onread hook while socket is in the free pool; restores normal stream read callback on socket reuse; guard still destroys sockets receiving unsolicited data while idle, but no longer adds public stream listeners
• 🟡 (08:37) PR #64004 reviewers who approved: @Renegade334, @anonrig (Yagiz Nizipli), @bjohansebas, @jasnell (James M Snell), @ronag (Robert Nagy); fast-tracked by @Renegade334 (fast-track label added Jun 19, 2026)
• 🟡 (08:37) PR #64004 CI runs: ci.nodejs.org/job/node-test-pull-request/74269, /74286, /74292, /74300
• 🟡 (08:37) PR #64004 backport status: backported to both v22.x-staging and v24.x-staging (labels backported-to-v22.x and backported-to-v24.x added by @richardlau on Jun 22, 2026)
• 🟡 (08:37) PR #64004 fix shipped in Node.js 24.18.0 'Krypton' (LTS) — release PR #64062, merged Jun 22-23, 2026; fix NOT shipped as a patch release, bundled in minor release v24.18.0
• 🟡 (08:37) Node.js 24.18.0 'Krypton' notable changes (from release commit): buffer: increase Buffer.poolSize default to 64 KiB (#63597); crypto: NSS 3.123.1 root certs (#63527), key arg name alignment (#62527), crypto.diffieHellman() key data (#62527), TurboSHAKE/KangarooTwelve (#62183); http: avoid stream listeners on idle agent sockets (#64004), writeInformation for 1xx codes (#63155); inspector: precise coverage start (#63079); stream: revert noop pause/resume on destroyed streams (#63834)
• 🟡 (08:37) PR #64004 also referenced by Node.js 22.23.1 'Jod' (LTS) release PR #64067 (merged Jun 22, 2026) — fix backported to v22.x
• 🟡 (08:37) @mcollina comment Jun 19, 2026: "unfortunately, we would need to backport this to node 22.x and 24.x to fix node-fetch@2" and "I'm sorry I should have caught this before shipping"
• 🟡 (08:37) @xnox comment Jun 22, 2026: noted "huge surge of people reverting/blocking tracking point releases and pinning back to previous v24 and v22 point releases" due to regression; warned that users pinning to older vulnerable Node versions will likely stay stuck there
• 🟡 (08:37) Craft CI log (getsentry/sentry-native, Jun 24, 2026 08:15 UTC) shows active ERR_STREAM_PREMATURE_CLOSE failure in production: craft publish 0.15.2 failing on GCS upload of sentry-native.zip; error: "Invalid response body while trying to fetch https://www.googleapis.com/oauth2/v4/token: Premature close", errno: ERR_STREAM_PREMATURE_CLOSE; running on Node gl-node/22.23.0 (google-api-nodejs-client/9.15.1); retry attempt 2 of 3 exhausted
• 🟡 (08:37) Craft CI failure confirms the craft codebase is running Node 22.23.0 (the affected version) at time of this session; fix not yet available to craft's Docker image (getsentry/craft:latest)
• 🟡 (08:37) Craft publish artifacts for sentry-native 0.15.2: libsentry-android.so (×4: 72.6 kB, 55.1 kB, 55.6 kB, 69.8 kB), libsentry.so (×4: 8.60 MB, 7.20 MB, 7.23 MB, 8.29 MB), sentry-native-ndk-0.15.2.zip (9.79 MB), sentry-native.zip (8.53 MB); targets github and registry already marked successful in state file; failing targets: gcs, maven, symbol-collector
• 🟡 (08:37) Related cross-ecosystem workarounds observed in PR #64004 thread: kaviththiranga/backstage-plugins pinned Node to 22.22 (openchoreo/backstage-plugins#649, merged); heroku/heroku-applink-nodejs#140 pinned Node 26.x to 26.3.0; Dwolla/dwolla-v2-node#103 disabled node-fetch gzip on token request as alternative workaround; backstage/backstage#34651 open; nodejs/docker-node#2544 closed
• 🟡 (08:37) CVE identifier for the original security fix: CVE-2026-48931 ("response queue poisoning in http.Agent"); GHSA: GHSA-w88c-7765-q5gg