Node Version 18.18.2 Fails to Instantiate Fetch Request with Proper Options

[gannan08]

Version

v18.18.2

Platform

Darwin 23.0.0 Darwin Kernel Version 23.0.0: Fri Sep 15 14:41:43 PDT 2023; root:xnu-10002.1.13~1/RELEASE_ARM64_T6000 arm64

Subsystem

n/a

What steps will reproduce the bug?

n/a

How often does it reproduce? Is there a required condition?

n/a

What is the expected behavior? Why is that the expected behavior?

n/a

What do you see instead?

Options are not preserved when instantiating a new Fetch Request object using a Request as the first parameter. This causes the options, that should have been copied, to be missing on the new Fetch Request object.

This behavior was fine on <= Node v18.18.1. It is broken on Node v18.18.2.

this.request = new globalThis.Request(this.request, {body: this._options.body}); 

The options fail to be copied. Is this the new expected behavior of the Request constructor after the patch?

See: https://github.com/nodejs/node/releases/tag/v18.18.2
See: sindresorhus/ky#535
See: https://github.com/sindresorhus/ky/blob/d372e2eccf9f47597f2c0f49cba286e19d7974b3/source/core/Ky.ts#L203

Additional information

May be related to latest CVE fixes.

[justinbather]

Has anyone taken this issue?

[BrettHoutz]

I am seeing the same behavior in Node v20.8.1 (the analogous security release for the v20 line).

[KhafraDev]

reproducible by the following code, but works properly in undici.

const request = new Request('https://a', {
  headers: {
    'test': 'abc'
  },
  method: 'POST'
})

const request1 = new Request(request, { body: 'abc' })

console.log(request1.headers.get('test')) // should be 'abc', is null

[KhafraDev]

this will be fixed by the next undici update (cc @nodejs/undici)

[mcollina]

@KhafraDev what PR is this fixed in?

[targos]

I believe it's nodejs/undici#2359

[KhafraDev]

I have no idea, I only had time to test if the new bundle fixed the issue, which it did.

[bricss]

Same issue here right now with both Node 18.8.2 and 21.0.0 ⚠️
All request headers are absolutely empty 💀 all the time in test cases, when fetch is used 🥶
Seems like a catastrophic bug 🪲 and needs an emergency 🚑 hotfix, asap 😱

[bricss]

Repro script:

import { rest } from 'msw';
import { setupServer } from 'msw/node';
import assert from 'node:assert/strict';

const url = 'https://somewhe.re/somewhat/endpoint';

const server = setupServer(
  rest.get(url, (req, res, ctx) => {
    const headers = [...req.headers];

    console.info(headers); // Will be empty []
    assert(headers.length, 'Headers should not be empty'); // Will throw here

    return res(ctx.status(200));
  }),
);

await server.listen();

await fetch(url, {
  headers: {
    'accept': 'application/json',
    'authorization': 'Bearer <token>',
  },
});

await server.close();

[mcollina]

Can you reproduce without msw?

[KhafraDev]

I posted a reproduction above

[mattcollier]

Is it true that once #50274 lands that this issue will be resolved?

I don't see anything in the release notes for undici@5.26.4 that seems directly related to this issue. Can anyone provide a status update?

[KhafraDev]

Nothing related to 5.26.3 should have broken this either, it's a strange issue.