NodeJS 24.17 CVE-2026-48931 fix affecting node-fetch - Premature close error

[balint-backmaker]

📜 Issue Labels

• Please familiarize yourself with the issue labels used in this project: LABELS.md

🔎 Search Terms

cloudflare-access-provider
catalog-client
node-fetch
24.17
fetch
Premature close

🗃️ Project Area

Auth

🔗 External Integration

Other

📝 Description & Context

Context

We had a minor incident on our backstage instance, starting yesterday.
We isolated the incident to the nodejs change from 24.16 to 24.17 (done automatically via docker)

This broke our login for our users and had to revert the NodeJS version to 24.16 and that fixed the issue.

Suspect node-fetch change

This breaks the cloudflare-access-provider plugin because we use fetch without fetch options, therefore likely defaulting to keep-alive: false causing issues.

Node 24.17 changed keep-alive socket behavior (CVE-2026-48931 / nodejs/node@be7e719c3f) which appears to disrupt outgoing connections to Cloudflare.

Workaround

Until the team finds the right solution, if you're hit by the issue, you can pin your nodejs to 24.16 or 22.22 (since the same CVE is applied in 22.23)

👍 Expected Behavior

I would expect to be able to upgrade to NodeJS 24.17 and use the latest version of the provider and logins keep working for my users when accessing through cloudflare.

Here's two uses of node-fetch that have no fetch options for them therefore no retries are applied when making these calls:

• https://github.com/backstage/backstage/blob/master/plugins/auth-backend-module-cloudflare-access-provider/src/helpers.ts#L55-L57
• https://github.com/backstage/backstage/blob/master/plugins/auth-backend-module-cloudflare-access-provider/src/helpers.ts#L187-L190

I am sadly not a NodeJS expert, please take my assertion with some criticism. 🙂

📦 Reproduction Repo

No response

🥾 Reproduction steps

1. use cloudflare-access-provider: @backstage/plugin-auth-backend-module-cloudflare-access-provider v0.4.15
2. use catalog-client: @backstage/catalog-client: ^1.15.1
3. use NodjeJS 24.17
4. Configure cloudflare login for your instance
5. Try to log in or load a previous entity page you had
   Then expect error logs like so:

Invalid response body while trying to fetch http://localhost:7007/api/catalog/entities?fields=kind,metadata.name,metadata.namespace,spec.lifecycle,spec.definition,spec.owner,spec.system&limit=500&filter=kind%3DAPI%2Cspec.type%3Dopenapi&offset=0: Premature close

Request failed with status 500 Invalid response body while trying to fetch http://localhost:7007/api/permission/authorize: Premature close

catalog.entity-fetch Invalid response body while trying to fetch http://localhost:7007/api/permission/authorize: Premature close

Have you read the Code of Conduct?

• I have read the Code of Conduct

Are you willing to submit PR?

No, I don't have time to work on this right now

[nimarion]

I am also having this issue with the azure auth provider. Pinning the nodejs version to 24.16 in our dockerfile solved the issue

[flash-me]

Same here. We were using node:24-* and then pinnen to node:24.16.0-0, which did the trick

[minusinus]

FYI: A patch is underway: nodejs/node#64004

[balint-backmaker]

FYI: A patch is underway: nodejs/node#64004

Thanks mate! This is where I bow my head that this may not be a backstage issue, but nonetheless y'all should know about this while it's getting fixed 🙏

[billyatroadie]

Appreciate this issue! This workaround fixed our issues.

[O5ten]

Appreciate this issue aswell, solved our issues by locking image version a bit harder to node:22.21-trixie-slim as we are on 22.

Upstream issues are the best. :)

[Jefwillems]

Same here, reproduced with github auth provider and azure auth provider