Intermittent errors fetching from raw.githubusercontent.com using mingw curl and nodejs on Windows, but not in PowerShell or Linux VM

This started happening a month or two ago. I have a node script which fetches from:

https://raw.githubusercontent.com/glowbuzzer/gbr/master/package.json

This has started failing about one in three times, but not with all methods (all running on the same machine).

❌ curl under Git for Windows

❌ nodejs script in Windows

❌ curl in Ubuntu under WSL

❌ nodejs in Ubuntu under WSL

✅ Invoke-WebRequest in PowerShell

✅ curl in guest Linux VM

✅ nodejs script in guest Linux VM

I've tried on home and work network with the same behaviour.

I suspect an SSL handshake issue. If Invoke-WebRequest didn't work in PowerShell, I would assume this was a corrupt Windows keystore or similar. Note that curl in Git for Windows is compiled using schannel (see log output).

Have done a fair amount of googling but cannot find anyone with quite the same problem. I should stress that this is intermittent - does not error on every request.

Any help much appreciated. Full logs follow.

Under Git for Windows

$ curl --version
curl 8.1.2 (x86_64-w64-mingw32) libcurl/8.1.2 Schannel zlib/1.2.13 brotli/1.0.9 zstd/1.5.5 libidn2/2.3.4 libpsl/0.21.2 (+libidn2/2.3.3) libssh2/1.11.0
Release-Date: 2023-05-30
Protocols: dict file ftp ftps gopher gophers http https imap imaps ldap ldaps mqtt pop3 pop3s rtsp scp sftp smb smbs smtp smtps telnet tftp
Features: alt-svc AsynchDNS brotli HSTS HTTPS-proxy IDN IPv6 Kerberos Largefile libz NTLM PSL SPNEGO SSL SSPI threadsafe UnixSockets zstd

$ curl https://raw.githubusercontent.com/glowbuzzer/gbr/master/package.json
curl: (35) Recv failure: Connection was reset

$ cat <<EOF > fetch.mjs
import https from "https";

console.log("making request")
const res=https.request("https://raw.githubusercontent.com/glowbuzzer/gbr/master/package.json", res => {
    console.log("statusCode", res.statusCode);

    res.on("data", d => {
        process.stdout.write(d);
    });
    res.on("error", e => {
        console.error(e);
    });
    res.on("end", () => {
        console.log("No more data in response.");
    });
});

res.end()
EOF

$ node fetch.mjs
making request
node:events:491
      throw er; // Unhandled 'error' event
      ^

Error: read ECONNRESET
    at TLSWrap.onStreamRead (node:internal/stream_base_commons:217:20)
Emitted 'error' event on ClientRequest instance at:
    at TLSSocket.socketErrorListener (node:_http_client:502:9)
    at TLSSocket.emit (node:events:513:28)
    at emitErrorNT (node:internal/streams/destroy:151:8)
    at emitErrorCloseNT (node:internal/streams/destroy:116:3)
    at process.processTicksAndRejections (node:internal/process/task_queues:82:21) {
  errno: -4077,
  code: 'ECONNRESET',
  syscall: 'read'
}

Node.js v18.16.0

Under WSL (Ubuntu)

$ curl https://raw.githubusercontent.com/glowbuzzer/gbr/master/package.json
curl: (35) OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to raw.githubusercontent.com:443

# same script as above in fetch.mjs

$ node fetch.mjs
making request
node:events:492
      throw er; // Unhandled 'error' event
      ^

Error: Client network socket disconnected before secure TLS connection was established
    at connResetException (node:internal/errors:720:14)
    at TLSSocket.onConnectEnd (node:_tls_wrap:1605:19)
    at TLSSocket.emit (node:events:526:35)
    at endReadableNT (node:internal/streams/readable:1359:12)
    at process.processTicksAndRejections (node:internal/process/task_queues:82:21)
Emitted 'error' event on ClientRequest instance at:
    at TLSSocket.socketErrorListener (node:_http_client:501:9)
    at TLSSocket.emit (node:events:514:28)
    at emitErrorNT (node:internal/streams/destroy:151:8)
    at emitErrorCloseNT (node:internal/streams/destroy:116:3)
    at process.processTicksAndRejections (node:internal/process/task_queues:82:21) {
  code: 'ECONNRESET',
  path: null,
  host: 'raw.githubusercontent.com',
  port: 443,
  localAddress: undefined
}

PowerShell

> Invoke-WebRequest https://raw.githubusercontent.com/glowbuzzer/gbr/master/package.json


StatusCode        : 200
StatusDescription : OK