From 87c8692e529fa326cd5b68ebfa71652b067d3e24 Mon Sep 17 00:00:00 2001 From: Eliya Sadan Date: Thu, 18 Jun 2026 22:18:28 +0300 Subject: [PATCH] fix(fetch): prefer native fetch to avoid node-fetch premature close node-fetch@2 (via cross-fetch) throws a false ERR_STREAM_PREMATURE_CLOSE on keep-alive responses on Node 22.23.0 and 24.17.0 (the CVE-2026-48931 http.Agent fix, nodejs/node#63989). Node built-in fetch (undici, Node 18+) is unaffected, so prefer it when present and fall back to cross-fetch on older runtimes. --- lib/fetch-polyfill.ts | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/lib/fetch-polyfill.ts b/lib/fetch-polyfill.ts index 2618358c4..2c7c2e5fe 100644 --- a/lib/fetch-polyfill.ts +++ b/lib/fetch-polyfill.ts @@ -19,4 +19,13 @@ const patchedFetch = (...args: Parameters) => { return crossFetch(...args); }; -export default patchedFetch as unknown as typeof fetch; +// node-fetch@2 (bundled by cross-fetch) throws a false ERR_STREAM_PREMATURE_CLOSE on +// keep-alive responses on Node >= 22.23.0 / 24.17.0 (nodejs/node#63989, the CVE-2026-48931 +// http.Agent fix). Node's built-in fetch (undici, Node >= 18) is unaffected, so prefer it +// when present and fall back to cross-fetch (node-fetch) only on older runtimes. +const polyfillFetch = + typeof globalThis.fetch === 'function' + ? (...args: Parameters) => globalThis.fetch(...args) + : patchedFetch; + +export default polyfillFetch as unknown as typeof fetch;