# What changed in jsonwebtoken

> 6 changes in jsonwebtoken 9 from its official release notes, upgrade guides and advisories: 4 breaking, 2 security. Each one cited. Sources checked 2026-10-27. HTML: https://unstale.sh/npm/jsonwebtoken/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## jsonwebtoken 9

### Breaking changes

- Key types must be valid for the signing or verification algorithm, restricting use of legacy keys. (9.0.0) — [release notes](https://github.com/auth0/node-jsonwebtoken/blob/HEAD/CHANGELOG.md)
- Support for Node.js 11 and below was removed, so applications must use a newer Node.js version. (9.0.0) — [release notes](https://github.com/auth0/node-jsonwebtoken/blob/HEAD/CHANGELOG.md)
- RSA keys must be at least 2048 bits to be used. (9.0.0) — [release notes](https://github.com/auth0/node-jsonwebtoken/blob/HEAD/CHANGELOG.md)
- verify() no longer accepts unsigned tokens by default, preventing insecure default algorithm handling. (9.0.0) — [release notes](https://github.com/auth0/node-jsonwebtoken/blob/HEAD/CHANGELOG.md)

### Security

- Fixed an insecure key retrieval implementation that could allow forging public or private tokens by switching from RSA to HMAC. (9.0.0) — [release notes](https://github.com/auth0/node-jsonwebtoken/blob/HEAD/CHANGELOG.md)
- Fixed an arbitrary file write vulnerability via the verify function. (9.0.0) — [release notes](https://github.com/auth0/node-jsonwebtoken/blob/HEAD/CHANGELOG.md)