Review requested:

• @nodejs/http
• @nodejs/net

@nodejs/releasers unfortunately, we would need to backport this to node 22.x and 24.x to fix node-fetch@2.

I'm sorry I should have caught this before shipping.

Fast-track has been requested by @Renegade334. Please 👍 to approve.

CI: https://ci.nodejs.org/job/node-test-pull-request/74269/

CI: https://ci.nodejs.org/job/node-test-pull-request/74286/

CI: https://ci.nodejs.org/job/node-test-pull-request/74292/

CI: https://ci.nodejs.org/job/node-test-pull-request/74300/

Is this also backported to 22 and 24 series, and a release created for both?

@xnox, this unfortunately didn't land as a patch release. I see it's bundled in the v24.18.0 minor release PR. I'm assuming it will be backported to 22 via a minor release as well.

If you expand all comments/events on #63989 the "88 remaining items" you can see a huge surge of people reverting/blocking tracking point releases and pinning back to previous v24 and v22 point releases because of this regression.

Thus the longer this fix is not out; the more people are pinning to older vulnerable node; and likely will be stuck on it - as very often when such pins are introduced, people forget to add a gate test and continuously attempt to upgrade.

What I don't fully understand is why this wasn't released as v24.17.1 quickly and instead was included in v24.18.0 🤔 Not what I expected and I wonder if including it in v24.18.0 is slowing it down from being available.

• Why was this change not tested against the package ecosystem?
• What is the plan to prevent changes that bring down many production systems (see http: node-fetch throws ERR_STREAM_PREMATURE_CLOSE on keep-alive socket closures after latest security releases #63989) being shipped in the future?

What I don't fully understand is why this wasn't released as v24.17.1 quickly and instead was included in v24.18.0 🤔 Not what I expected and I wonder if including it in v24.18.0 is slowing it down from being available.

Shipping a Node.js release is somewhat hard work. Node.js is a community of volunteers.

Why was this change not tested against the package ecosystem?

Because node-fetch is not part of https://github.com/nodejs/citgm. Given that it's essentially unmaintained (last release: 3 years ago), it fails the basic requirements to be there.

What is the plan to prevent changes that bring down many production systems (see #63989) being shipped in the future?

I'm sorry to disappoint you, but Node.js is a community of volunteers. There are no plans, as everyone here does their best. You can, as always, volunteer your time or resources to improve things.