fix(backend,tanstack-react-start): omit cross-realm AbortSignal in proxy and patchRequest

Author: jacekradko

.changeset/node24-clerk-request-signal.md

@@ -1,6 +1,11 @@
 ---
 '@clerk/backend': patch
 '@clerk/react-router': patch
+'@clerk/tanstack-react-start': patch
 ---
 
-Fix `Request` cloning to omit cross-realm `AbortSignal`. Node 24's bundled undici tightened the `instanceof AbortSignal` check on `RequestInit.signal`, which broke cloning of framework-specific requests such as `NextRequest` (in `@clerk/backend`'s `ClerkRequest`) and any subclassed Request passed through `patchRequest` (in `@clerk/react-router`).
+Fix `Request` cloning and outbound `fetch` to omit cross-realm `AbortSignal`. Node 24's bundled undici tightened the `instanceof AbortSignal` check on `RequestInit.signal`, which broke:
+
+- Cloning framework-specific requests such as `NextRequest` in `@clerk/backend`'s `ClerkRequest`.
+- Subclassed `Request`s passed through `patchRequest` in `@clerk/react-router` and `@clerk/tanstack-react-start`.
+- Frontend API proxying in `@clerk/backend`'s `clerkFrontendApiProxy`, which forwarded the inbound request's signal to the upstream `fetch`. Abort propagation will be restored in a follow-up via an in-realm `AbortController` bridge.

packages/backend/src/__tests__/proxy.test.ts

@@ -572,7 +572,11 @@ describe('proxy', () => {
       expect(response.status).toBe(200);
     });
 
-    it('propagates abort signal to upstream fetch', async () => {
+    it('omits signal from upstream fetch (Node 24 undici cross-realm AbortSignal)', async () => {
+      // Node 24's bundled undici tightened the instanceof AbortSignal check on
+      // RequestInit.signal, which throws on cross-realm signals carried by
+      // framework Request subclasses. Until we bridge abort propagation via an
+      // in-realm AbortController, the signal is intentionally omitted.
       const mockResponse = new Response(JSON.stringify({}), { status: 200 });
       mockFetch.mockResolvedValue(mockResponse);
 
@@ -587,7 +591,7 @@ describe('proxy', () => {
       });
 
       const [, options] = mockFetch.mock.calls[0];
-      expect(options.signal).toBe(request.signal);
+      expect(options.signal).toBeUndefined();
     });
 
     it('includes Cache-Control: no-store on error responses', async () => {

packages/backend/src/proxy.ts

@@ -297,12 +297,15 @@ export async function clerkFrontendApiProxy(request: Request, options?: Frontend
 
   try {
     // Make the proxied request
-    // TODO: Consider adding AbortSignal.timeout(30_000) via AbortSignal.any()
+    // TODO: Restore abort cascade via an in-realm AbortController bridge,
+    // and consider adding AbortSignal.timeout(30_000) via AbortSignal.any().
+    // `request.signal` is intentionally omitted: Node 24's bundled undici
+    // tightened the instanceof AbortSignal check on RequestInit.signal, which
+    // rejects cross-realm signals carried by framework Request subclasses.
     const fetchOptions: RequestInit = {
       method: request.method,
       headers,
       redirect: 'manual',
-      signal: request.signal,
     };
 
     // Only set duplex when body is present (required for streaming bodies)

packages/tanstack-react-start/src/server/utils/index.ts

@@ -69,12 +69,14 @@ export function getResponseClerkState(requestState: RequestState, additionalStat
  * @internal
  */
 export const patchRequest = (request: Request) => {
+  // Omit `signal` from the clone: Node 24's bundled undici tightened the
+  // instanceof AbortSignal check, which rejects cross-realm signals (e.g.
+  // those carried by framework Request subclasses).
   const clonedRequest = new Request(request.url, {
     headers: request.headers,
     method: request.method,
     redirect: request.redirect,
     cache: request.cache,
-    signal: request.signal,
   });
 
   // If duplex is not set, set it to 'half' to avoid duplex issues with unidici