[Bug]:

[stevewlrls]

Version

1.61.1

Steps to reproduce

1. Install playwright per instructions on website.
2. run NODE_DEBUG=tls,net DEBUG=pw:browser* npx playwright install chromium

Expected behavior

I expect to see a successful download and install

Actual behavior

Following output produced:
Downloading Chrome for Testing 149.0.7827.55 (playwright chromium v1228) from https://cdn.playwright.dev/builds/cft/149.0.7827.55/mac-arm64/chrome-mac-arm64.zip
TLS 13775: client _init handle? true
NET 13775: pipe false null
TLS 13775: client initRead handle? true buffered? false
NET 13775: _read - n 65536 isConnecting? true hasHandle? true
NET 13775: _read wait for connection
NET 13775: connect: attempting to connect to ::ffff:150.171.109.213:443 (addressType: 6)
NET 13775: afterConnect
TLS 13775: client _start handle? true connecting? false requestOCSP? false
NET 13775: _read - n 65536 isConnecting? false hasHandle? true
NET 13775: Socket._handle.readStart
NET 13775: destroy
NET 13775: close
NET 13775: close handle
Error: Client network socket disconnected before secure TLS connection was established
at TLSSocket.onConnectEnd (node:internal/tls/wrap:1709:19)
at TLSSocket.emit (node:events:521:24)
at endReadableNT (node:internal/streams/readable:1735:12)
at process.processTicksAndRejections (node:internal/process/task_queues:90:21) {
code: 'ECONNRESET',
path: null,
host: '::ffff:150.171.109.213',
port: 443,
localAddress: undefined
}

Additional context

With help from GPT-5.3-Codex, I was able to find that curl finds the first response from the CDN to be a redirect:

curl -v --http1.1 --resolve cdn.playwright.dev:443:150.171.109.216 \
  -o /dev/null \
  "https://cdn.playwright.dev/builds/cft/149.0.7827.55/mac-arm64/chrome-mac-arm64.zip"
* Added cdn.playwright.dev:443:150.171.109.216 to DNS cache
* Hostname cdn.playwright.dev was found in DNS cache
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0*   Trying 150.171.109.216:443...
* Connected to cdn.playwright.dev (150.171.109.216) port 443
* ALPN: curl offers http/1.1
* (304) (OUT), TLS handshake, Client hello (1):
} [320 bytes data]
*  CAfile: /etc/ssl/cert.pem
*  CApath: none
* (304) (IN), TLS handshake, Server hello (2):
{ [88 bytes data]
* (304) (OUT), TLS handshake, Client hello (1):
} [353 bytes data]
* (304) (IN), TLS handshake, Server hello (2):
{ [155 bytes data]
* (304) (IN), TLS handshake, Unknown (8):
{ [25 bytes data]
* (304) (IN), TLS handshake, Certificate (11):
{ [3684 bytes data]
* (304) (IN), TLS handshake, CERT verify (15):
{ [264 bytes data]
* (304) (IN), TLS handshake, Finished (20):
{ [52 bytes data]
* (304) (OUT), TLS handshake, Finished (20):
} [52 bytes data]
* SSL connection using TLSv1.3 / AEAD-AES256-GCM-SHA384 / [blank] / UNDEF
* ALPN: server accepted http/1.1
* Server certificate:
*  subject: CN=cdn.playwright.dev
*  start date: May 23 00:00:00 2026 GMT
*  expire date: Nov 23 23:59:59 2026 GMT
*  subjectAltName: host "cdn.playwright.dev" matched cert's "cdn.playwright.dev"
*  issuer: C=US; O=DigiCert Inc; OU=www.digicert.com; CN=GeoTrust TLS RSA CA G1
*  SSL certificate verify ok.
* using HTTP/1.x
> GET /builds/cft/149.0.7827.55/mac-arm64/chrome-mac-arm64.zip HTTP/1.1
> Host: cdn.playwright.dev
> User-Agent: curl/8.7.1
> Accept: */*
> 
* Request completely sent off
< HTTP/1.1 307 Temporary Redirect
< Date: Thu, 16 Jul 2026 15:44:32 GMT
< Content-Type: text/html
< Content-Length: 0
< Connection: keep-alive
< Location: https://storage.googleapis.com/chrome-for-testing-public/149.0.7827.55/mac-arm64/chrome-mac-arm64.zip
< x-azure-ref: 20260716T154432Z-15f9cc68ffdb67vmhC1LONn2x80000000d90000000005h2a
< X-Cache: CONFIG_NOCACHE
< 
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
* Connection #0 to host cdn.playwright.dev left intact

Repeating the above command with -L (follow redirects) allowed a successful download from the new URL returned by the CDN.

We also tried a small NodeJS script to rule out certificate or stack issues:

node -e "
const https = require('https');
const fs = require('fs');

const start = 'https://cdn.playwright.dev/builds/cft/149.0.7827.55/mac-arm64/chrome-mac-arm64.zip';

function fetch(url, redirects = 0) {
  https.get(url, res => {
    console.log('status', res.statusCode, 'url', url);
    if ([301, 302, 303, 307, 308].includes(res.statusCode || 0) && res.headers.location && redirects < 5) {
      const next = new URL(res.headers.location, url).toString();
      console.log('redirect ->', next);
      res.resume();
      return fetch(next, redirects + 1);
    }

    const out = fs.createWriteStream('/tmp/chrome-mac-arm64.zip');
    let bytes = 0;

    res.on('data', chunk => { bytes += chunk.length; });
    res.on('error', err => {
      console.error('response error', err);
      process.exit(1);
    });
    out.on('error', err => {
      console.error('file error', err);
      process.exit(1);
    });
    out.on('finish', () => {
      console.log('download complete', bytes, 'bytes');
    });

    res.pipe(out);
  }).on('error', err => {
    console.error('request error', err);
    process.exit(1);
  });
}

fetch(start);
"

That script was able to see the 307 and then follow the redirect successfully.

I am attempting the download from the UK and it is possible (I think) that this influences the redirect URL and perhaps other behaviours of the CDN.

Note that although the environment report identifies Claude Code as the IDE, I am actually using VS Code and the MacOS Terminal (zsh) with support from ChatGPT (in Git copilot). I haven't asked Claude to try the command.

Environment

System:
    OS: macOS 26.5.2
    CPU: (8) arm64 Apple M3
    Memory: 173.17 MB / 16.00 GB
  Binaries:
    Node: 24.16.0 - /Users/stevenwheeler/.nvm/versions/node/v24.16.0/bin/node
    Yarn: 1.22.22 - /Users/stevenwheeler/.yarn/bin/yarn
    npm: 11.18.0 - /Users/stevenwheeler/.nvm/versions/node/v24.16.0/bin/npm
  IDEs:
    Claude Code: 2.1.206 - /Users/stevenwheeler/.nvm/versions/node/v24.16.0/bin/claude
  Languages:
    Bash: 3.2.57 - /bin/bash
  npmPackages:
    @playwright/test: ^1.61.1 => 1.61.1

[dgozman]

@stevewlrls Could this be related to the broken Node.js 24.16? See #41000 for more details. I'd recommend to update node (use latest 24 or 26) and try again. Please let me know whether this helps.

[stevewlrls]

I normally run with the LTS version of Node.js ... I tried installing that again (to get latest LTS) with the same results.

% nvm install --lts
Installing latest LTS version.
Downloading and installing node v24.18.0...
Downloading https://nodejs.org/dist/v24.18.0/node-v24.18.0-darwin-arm64.tar.xz...
########################################################################################################################################### 100.0%
Computing checksum with sha256sum
Checksums matched!
Now using node v24.18.0 (npm v11.16.0)
% npx playwright install
Downloading Chrome for Testing 149.0.7827.55 (playwright chromium v1228) from https://cdn.playwright.dev/builds/cft/149.0.7827.55/mac-arm64/chrome-mac-arm64.zip
Error: Client network socket disconnected before secure TLS connection was established
    at TLSSocket.onConnectEnd (node:internal/tls/wrap:1800:19)
    at TLSSocket.emit (node:events:521:24)
    at endReadableNT (node:internal/streams/readable:1729:12)
    at process.processTicksAndRejections (node:internal/process/task_queues:90:21) {
  code: 'ECONNRESET',
  path: null,
  host: '::ffff:150.171.109.209',
  port: 443,
  localAddress: undefined
}

[dgozman]

@stevewlrls I'm not really sure how to help you. It's strange that curl works, while playwright fails, but perhaps the environment is somehow different between the two? Anyway, there's nothing we can really help with in this case. Sorry.

[stevewlrls]

Ok ... I guess I'll have to try to build Playwright from source so I can debug it (or the environmental impact) for myself. Before reporting this issue, I did explore whether others were having a similar problem, and they are: particularly, it seems, on mobile networks in the UK. It's only a recent issue for me: this used to work on a previous LTS version of Node. I don't really want to revert just for Playwright.