Dashboard › craft › Node.js 22.23.0/24.17.0 ERR_STREAM_PREM…

Node.js 22.23.0/24.17.0 ERR_STREAM_PREMATURE_CLOSE regression breaks node-fetch@2 + GCS

Category: gotcha
Confidence: 1.00
ID: 019ef93b-5000-7369-b906-669b474ae339
Project ID: e16af391-c497-4837-b681-c849a5514499
Cross-project: No
Recalled in other projects: 2
Source session: 1BlOrjKSHFnf58tXj
Created: 2026-06-24 10:44:34
Updated: 2026-06-24 10:44:34

Cross-Project Recalls

ProjectHitsLast recalled
opencode 1 9d ago
cli 2 2026-06-25

Content

Trap: Node 22.23.0 and 24.17.0 security releases (CVE-2026-48931, 'response queue poisoning in http.Agent') added a public data listener on idle agent sockets. node-fetch@2 detects this listener and throws false ERR_STREAM_PREMATURE_CLOSE errors on keep-alive socket reuse — looks like a network/GCS flake but is a Node regression. Affects any stack using googleapis/@google-cloud/storage/gaxios/node-fetch@2. Fix: upgrade to Node 22.23.1 or 24.18.0 (PR nodejs/node#64004 backported to both). Pinning back to 22.22.x/24.16.0 also works but leaves CVE-2026-48931 unpatched.

Move to: