FetchError: Premature close on Linux when using node-fetch@2.x with chunked responses

[andrealbinop]

Describe the bug

When running on Linux, all API calls made through the SDK fail intermittently (but reliably on CI) with:

FetchError: Invalid response body while trying to fetch https://***.okta.com/api/v1/...: Premature close
at Gunzip. (.../node-fetch/lib/index.js:400:12)

This is caused by a known unfixed bug in node-fetch@2.x (node-fetch/node-fetch#1576) where the chunked response terminator detection has a boundary condition that fires a false-positive Premature close error. The bug only manifests on Linux (not macOS) due to differences in how TCP packets are delivered, making it invisible in local development but a consistent failure in CI.

The node-fetch@2.x branch is effectively unmaintained — the fix PR (node-fetch/node-fetch#1687) has been open since 2023 with no maintainer activity and no release shipping the fix.

Reproduction Steps?

1. Run the SDK on a Linux host (e.g. a GitHub Actions Ubuntu runner)
2. Make multiple sequential API calls (enough to trigger chunked response boundary conditions)
3. Observe FetchError: Premature close on responses from endpoints like GET /api/v1/apps

Not reproducible on macOS.

SDK Versions

System:
OS: Ubuntu 22.04.5 LTS
CPU: (4) x64
Shell: 5.1.16 - /bin/bash
Binaries:
Node: 22.22.0 - ~/.nvm/versions/node/v22.22.0/bin/node
npm: 10.9.2
pnpm: 10.30.2
npmPackages:
@okta/okta-sdk-nodejs: ^8.0.0 => 8.0.0

Additional Information

Workaround:

Force node-fetch@^3.3.2 via package manager overrides. Since node-fetch@3.x is ESM-only and the SDK uses require('node-fetch') (CJS), src/request-executor.js also needs a one-line fix:

-const nodeFetch = require('node-fetch');
+const nodeFetch = require('node-fetch').default ?? require('node-fetch');

[preaction]

In my system, this is definitely related to nodejs/node#63989. If I downgrade Node to a version before the identified security patch, the problem goes away.