Charles Bochet
840c41e6b7
## Context Since v2.19.0 rolled out to prod (2026-07-07), workers are flooded with mid-body fetch failures — `Invalid response body while trying to fetch …: Premature close` — on Gmail message import (Sentry TWENTY-SERVER-D3X, ~22k events/day, ~1k users) and, simultaneously, on Cloudflare custom-domain checks (TWENTY-SERVER-HXW/HXT). Both code paths were unchanged between v2.18.5 and v2.19.0; their only shared layer is the runtime HTTP stack. The one relevant change in v2.19.0 is #22529: the base image bump `node:24.16.0-alpine` → `node:24.17.0-alpine`. Node 24.17.0 patched exactly the components under these fetches: - `http`: CVE-2026-48931 — idle keep-alive sockets in the Agent pool now get `socket.resume()` + a destroy-on-data guard on every free→reuse cycle - `deps`: llhttp 9.4.2 (security bump of the HTTP parser that decides when a chunked body is complete) The messaging import loop cycles the same keep-alive socket through the pool once per message fetched, so any per-cycle failure probability is amplified by prod volume. (Note: undici's equivalent CVE fix needed two follow-up commits for races of this exact kind — sockets destroyed while freshly handed to a request.) ## What this PR does Pins the base image back to `node:24.16.0-alpine3.23` (same digest v2.18.5 shipped with) on all four stages, and updates the security note accordingly. This doubles as the definitive root-cause test: if the premature-close rate drops back to its historical baseline on the rebuilt image, the 24.17.0 HTTP-stack change is confirmed and we can file a solid upstream report to nodejs/node. ## Trade-off — please weigh in This re-exposes what #22529 fixed: 24.16.0 statically links OpenSSL 3.5.6, so the scanner will re-flag CVE-2026-48930 (TLS embedded-nul hostname authority rebinding, CVSS 9.8) on the node binary. There is no 24.x release newer than 24.17.0 yet. The Dockerfile carries a TODO to re-bump as soon as a fixed 24.x ships. ## Related - #22671 classifies `ERR_STREAM_PREMATURE_CLOSE` as a transient (retryable) network error at the application level — worth landing regardless of this rollback, since sync channels currently hard-fail to `FAILED_UNKNOWN` on what is a plain network race. <!-- This is an auto-generated description by cubic. --> <a href="https://cubic.dev/pr/twentyhq/twenty/pull/22673?utm_source=github" target="_blank" rel="noopener noreferrer" data-no-image-dialog="true"><picture><source media="(prefers-color-scheme: dark)" srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img alt="Review in cubic" src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a> <!-- End of auto-generated description by cubic. -->
The #1 Open-Source CRM
Website · 
Documentation · 
Roadmap · 
Discord · 
Figma
Why Twenty
Twenty gives technical teams the building blocks for a custom CRM that meets complex business needs and quickly adapts as the business evolves. Twenty is the CRM you build, ship, and version like the rest of your stack.
Learn more about why we built Twenty
Installation
Cloud
The fastest way to get started. Sign up at twenty.com and spin up a workspace in under a minute, with no infrastructure to manage and always up to date.
Build an app
Scaffold a new app with the Twenty CLI:
npx create-twenty-app my-app
Define objects, fields, and views as code:
import { defineObject, FieldType } from 'twenty-sdk/define';
export default defineObject({
nameSingular: 'deal',
namePlural: 'deals',
labelSingular: 'Deal',
labelPlural: 'Deals',
fields: [
{ name: 'name', label: 'Name', type: FieldType.TEXT },
{ name: 'amount', label: 'Amount', type: FieldType.CURRENCY },
{ name: 'closeDate', label: 'Close Date', type: FieldType.DATE_TIME },
],
});
Then ship it to your workspace:
npx twenty app:publish --private
See the app development guide for objects, views, agents, and logic functions.
Self-hosting
Run Twenty on your own infrastructure with Docker Compose, or contribute locally via the local setup guide.
Everything you need
Twenty gives you the building blocks of a modern CRM (objects, views, workflows, and agents) and lets you extend them as code. Here's a tour of what's in the box.
Want to go deeper? Read the 
User Guide for product walkthroughs, or the Documentation for developer reference.
|
|
|
|
|
|
Learn more about version control in doc
Stack
TypeScript
Nx
NestJS, with BullMQ, 
PostgreSQL, 
Redis
React, with Jotai, Linaria and Lingui
Thanks
Thanks to these amazing services that we use and recommend for code review (Greptile), catching bugs (Sentry) and translating (Crowdin).
Join the Community
Star the repo · Discord · 
Feature requests · Releases · 
X · 
LinkedIn · 
Crowdin · 
Contribute