@browserbasehq/sdk fails on Node ≥24.17.0 — ERR_STREAM_PREMATURE_CLOSE on every API call (node-fetch@2)

[jdjkelly]

Summary

Every Browserbase SDK request throws ERR_STREAM_PREMATURE_CLOSE on Node.js ≥ 24.17.0:

FetchError: Invalid response body while trying to fetch https://api.browserbase.com/v1/sessions: Premature close
    code: 'ERR_STREAM_PREMATURE_CLOSE'
    type: 'system'

This takes down anything built on the SDK, including Stagehand (BROWSERBASE env): sessions.create() / sessions.retrieve() fail, so stagehand.init() never completes and sessions show ~0s duration in the dashboard.

Root cause

The SDK's node runtime shim (_shims/node-runtime.js, getRuntime().fetch = nf.default) uses node-fetch@2 with agentkeepalive / http.Agent. Node 24.17.0 shipped CVE-2026-48931 "fix response queue poisoning in http.Agent" (+ llhttp 9.4.2), and node-fetch@2's keep-alive response-stream handling can't cope — it reports the body as prematurely closed. node-fetch@2.7.0 is the last v2 release and is effectively unmaintained.

Node's own https and undici (global fetch) are unaffected.

Minimal reproduction (Node 24.17.0)

const Browserbase = require('@browserbasehq/sdk').default;
const bb = new Browserbase({ apiKey: process.env.BROWSERBASE_API_KEY });
await bb.sessions.list({ status: 'RUNNING' });   // ❌ ERR_STREAM_PREMATURE_CLOSE

Isolation matrix (same host, same key, same endpoint)

HTTP client	Node 24.16.0	Node 24.17.0
node-fetch@2 (SDK default)	✅	❌ 5/5 ERR_STREAM_PREMATURE_CLOSE
undici / global fetch	✅	✅
core https.request	✅	✅

Fix that works (verified)

Have the SDK prefer global fetch (undici) on Node ≥18. Confirmed working end-to-end (create → retrieve → CDP connect) on Node 24.17.0:

new Browserbase({ apiKey, fetch: (...a) => globalThis.fetch(...a) }); // ✅

i.e. getRuntime().fetch should be globalThis.fetch ?? nodeFetch.

Environment

• @browserbasehq/sdk 2.12.0 (also reproduces conceptually on 2.15.0 — still depends on node-fetch@^2.6.7)
• @browserbasehq/stagehand 3.4.0 (and 3.6.0, via the same SDK dep)
• Node 24.17.0 (works on 24.16.0)
• macOS + Linux (prod)