npm / jsonwebtoken
jsonwebtoken
What changed in jsonwebtoken 9, from its official release notes, upgrade guides and advisories. Also covers @types/jsonwebtoken. Sources checked 2026-10-27.
4 breaking2 security
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli initjsonwebtoken 96 changes
Breaking changes 4
Key types must be valid for the signing or verification algorithm, restricting use of legacy keys.
Support for Node.js 11 and below was removed, so applications must use a newer Node.js version.
RSA keys must be at least 2048 bits to be used.
verify() no longer accepts unsigned tokens by default, preventing insecure default algorithm handling.
Security 2
Fixed an insecure key retrieval implementation that could allow forging public or private tokens by switching from RSA to HMAC.
Fixed an arbitrary file write vulnerability via the verify function.