fix(fetch): prefer native fetch to avoid node-fetch premature close#742
Merged
Conversation
node-fetch@2 (via cross-fetch) throws a false ERR_STREAM_PREMATURE_CLOSE on keep-alive responses on Node 22.23.0 and 24.17.0 (the CVE-2026-48931 http.Agent fix, nodejs/node#63989). Node built-in fetch (undici, Node 18+) is unaffected, so prefer it when present and fall back to cross-fetch on older runtimes.
|
🐕 Starting automated code review... Analyzing changes... |
🐕 Suggested ReviewersThe reviewers are selected based on recent contributions to the affected file, ensuring they are familiar with the latest changes and context. This selection covers different contributors to provide a broader review perspective with expertise directly related to the fetch polyfill.
Suggested by Shuni based on git history and PR context. Names are not @-mentioned to avoid notifying anyone — request a review from whoever fits best. |
dorsha
approved these changes
Jun 18, 2026
This was referenced Jun 19, 2026
Merged
dorsha
pushed a commit
to descope/descope-js
that referenced
this pull request
Jun 19, 2026
…ix) (#1419) ## Summary `@descope/nextjs-sdk` pins `@descope/node-sdk` to exactly **`2.6.0`**, which still fetches the JWKS via `cross-fetch` → **`node-fetch@2`**. `node-fetch@2` cannot decode **Brotli (`content-encoding: br`)** responses, so when the CDN in front of `api.descope.com` serves the keys endpoint with `br`, the fetch dies with `ERR_STREAM_PREMATURE_CLOSE`, `validateJwt` throws, and `authMiddleware`/`session()` reject **every valid token** → infinite `/sign-in` loop for all users. `@descope/node-sdk@2.8.0` already fixes this (descope/node-sdk#742 — *"prefer native fetch to avoid node-fetch premature close"*): it uses the runtime's native `fetch` (undici), which decodes Brotli correctly, and only falls back to `cross-fetch` on older runtimes. This PR bumps the pinned dependency so `nextjs-sdk` consumers actually receive that fix. ```diff - "@descope/node-sdk": "2.6.0", + "@descope/node-sdk": "2.8.0", ``` `node-sdk@2.8.0`'s declared dependencies are identical to `2.6.0` (`core-js-sdk 2.62.1`, `cross-fetch 4.1.0`, `jose 5.2.2`, `tslib 2.8.1`), so the lockfile change is minimal and `pnpm install --frozen-lockfile` passes. ## Why it's hard to diagnose The failure is CDN-edge/POP dependent: it can appear suddenly with **no** application or SDK change (an edge simply starts serving `br`), and it rejects even cryptographically valid `DS` cookies. ## Context Reported in #1418 with full root-cause analysis, in-pod isolation evidence, and a consumer-side bundler workaround. This PR is the upstream follow-up so the workaround is no longer necessary. Refs #1418 Refs descope/node-sdk#742 Made with [Cursor](https://cursor.com) Co-authored-by: danpe <danpe@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Related Issues
Related: nodejs/node#63989
Description
Problem
On Node 22.23.0 and 24.17.0 (the June 2026 security release, CVE-2026-48931
http.Agentfix),cross-fetch->node-fetch@2.7.0throws a falseFetchError: ... Premature close [ERR_STREAM_PREMATURE_CLOSE]on keep-alive responses. Every SDK request runs throughcross-fetch, so this breaksvalidateSession, key fetches, and management calls for any app on those runtimes (commonly hit via unpinnednode:22/node:24base images). Node's built-in fetch (undici) is unaffected.Fix
lib/fetch-polyfill.tsprefers the globalfetch(undici, Node 18+) and falls back tocross-fetchonly on older runtimes.Behavior
ERR_STREAM_PREMATURE_CLOSEon Node 22.23.0 / 24.17.0.Tests
/v2/keysmock on Node 22.23.0 and 24.17.0: SDKgetKeysucceeds on the native path and fails on the forced cross-fetch path. Both pass on Node 24.16.0 (unaffected release).Must