http: avoid stream listeners on idle agent sockets

[mcollina]

Fixes: #63989

The response-queue-poisoning guard added to idle http.Agent sockets used a public 'data' listener. That made node-fetch@2 observe socket.listenerCount('data') > 0 during response close and report false ERR_STREAM_PREMATURE_CLOSE errors.

This changes the idle-socket guard to use the socket handle's internal onread hook while the socket is in the free pool, restoring the normal stream read callback when the socket is reused. The guard still destroys sockets that receive unsolicited data while idle, but it no longer adds public stream listeners.

[nodejs-github-bot]

Review requested:

• @nodejs/http
• @nodejs/net

[mcollina]

@nodejs/releasers unfortunately, we would need to backport this to node 22.x and 24.x to fix node-fetch@2.

[mcollina]

I'm sorry I should have caught this before shipping.

[Renegade334]

Side-note: I had a cursory look for guidance on Node.js internals managing EventEmitter events on emitter-derived Node.js classes, and found none. My feeling is that we don't ordinarily consider changes related to internally-managed event listeners to be semver-major, even though they're publicly observable. Maybe we should elucidate what our stance is, and make it explicit in the EventEmitter documentation?

[github-actions]

Fast-track has been requested by @Renegade334. Please 👍 to approve.

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/74269/

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/74286/

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/74292/

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/74300/

[nodejs-github-bot]

Commit Queue failed

- Loading data for nodejs/node/pull/64004
✔  Done loading data for nodejs/node/pull/64004
----------------------------------- PR info ------------------------------------
Title      http: avoid stream listeners on idle agent sockets (#64004)
Author     Matteo Collina <matteo.collina@gmail.com> (@mcollina)
Branch     mcollina:fix-http-agent-free-socket-onread -> nodejs:main
Labels     http, fast-track, author ready, needs-ci, lts-watch-v22.x, lts-watch-v24.x
Commits    1
 - http: avoid stream listeners on idle agent sockets
Committers 1
 - Matteo Collina <hello@matteocollina.com>
PR-URL: https://github.com/nodejs/node/pull/64004
Fixes: https://github.com/nodejs/node/issues/63989
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Robert Nagy <ronagy@icloud.com>
------------------------------ Generated metadata ------------------------------
PR-URL: https://github.com/nodejs/node/pull/64004
Fixes: https://github.com/nodejs/node/issues/63989
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Robert Nagy <ronagy@icloud.com>
--------------------------------------------------------------------------------
   ℹ  This PR was created on Fri, 19 Jun 2026 14:49:05 GMT
   ✔  Approvals: 4
   ✔  - René (@Renegade334): https://github.com/nodejs/node/pull/64004#pullrequestreview-4533753549
   ✔  - Yagiz Nizipli (@anonrig) (TSC): https://github.com/nodejs/node/pull/64004#pullrequestreview-4533914964
   ✔  - James M Snell (@jasnell) (TSC): https://github.com/nodejs/node/pull/64004#pullrequestreview-4535587792
   ✔  - Robert Nagy (@ronag) (TSC): https://github.com/nodejs/node/pull/64004#pullrequestreview-4536884413
   ℹ  This PR is being fast-tracked
   ✘  This PR needs to wait 25 more hours to land (or 0 hours if there is 1 more approval (👍) of the fast-track request from collaborators).
   ✔  Last GitHub CI successful
   ℹ  Last Full PR CI on 2026-06-20T10:50:37Z: https://ci.nodejs.org/job/node-test-pull-request/74300/
- Querying data for job/node-test-pull-request/74300/
✔  Build data downloaded
   ✔  Last Jenkins CI successful
--------------------------------------------------------------------------------
   ✔  Aborted `git node land` session in /home/runner/work/node/node/.ncu

https://github.com/nodejs/node/actions/runs/27873727043

[nodejs-github-bot]

Landed in 57a4932

[xnox]

Is this also backported to 22 and 24 series, and a release created for both?

[kurtaking]

Is this also backported to 22 and 24 series, and a release created for both?

@xnox, this unfortunately didn't land as a patch release. I see it's bundled in the v24.18.0 minor release PR. I'm assuming it will be backported to 22 via a minor release as well.

[xnox]

Is this also backported to 22 and 24 series, and a release created for both?

@xnox, this unfortunately didn't land as a patch release. I see it's bundled in the v24.18.0 minor release PR. I'm assuming it will be backported to 22 via a minor release as well.

If you expand all comments/events on #63989 the "88 remaining items" you can see a huge surge of people reverting/blocking tracking point releases and pinning back to previous v24 and v22 point releases because of this regression.

Thus the longer this fix is not out; the more people are pinning to older vulnerable node; and likely will be stuck on it - as very often when such pins are introduced, people forget to add a gate test and continuously attempt to upgrade.