Distillation

Date: June 24, 2026

• 🟡 (08:35) Node.js issue #63989 details confirmed: ERR_STREAM_PREMATURE_CLOSE thrown by node-fetch@2.7.0 via gaxios@6.7.1 on keep-alive socket reuse after Node.js 24.17.0 security release
• 🟡 (08:35) Issue #63989 root cause: Node 24.17.0 changelog entry "http: fix response queue poisoning in http.Agent" (plus TLS/SNI changes) altered keep-alive socket reuse timing, exposing a latent node-fetch@2 bug (node-fetch/node-fetch#1767: "Malformed chunked response detector creates false-positive 'premature close' errors when HTTP Agent involved")
• 🟡 (08:35) Issue #63989 affected stack: googleapis@144 / @google-cloud/storage@7.14.0 / google-auth-library@9.15.0 → gaxios@6.7.1 → node-fetch@2.7.0 → node:http with keep-alive http.Agent
• 🟡 (08:35) Issue #63989 bisect: fails reliably on Node 24.17.0; pinning back to node:24.16.0-slim fully resolves both failure paths
• 🟡 (08:35) Issue #63989 error messages: FetchError: Invalid response body while trying to fetch https://www.googleapis.com/drive/v3/files?...: Premature close code: ERR_STREAM_PREMATURE_CLOSE and SigningError: Invalid response body while trying to fetch https://iamcredentials.googleapis.com/.../:signBlob: Premature close
• 🟡 (08:35) Issue #63989 fix PR: nodejs/node#64004 (referenced as closing the issue; status: closed)
• 🟡 (08:35) Issue #63989 platform: reproduced on Linux x64 (Cloud Run / gVisor, Debian 12) AND Windows 11 x64 (independent report via firebase/firebase-tools#10681); platform-independent
• 🟡 (08:35) Issue #63989 assigned to: @mcollina; labeled: confirmed-bug, http
• 🟡 (08:35) Assistant next step: follow PR #64004 and check which Node.js patch version contains the fix, then inspect craft codebase for current pinned Node version