unstale

pypi / pyjwt

pyjwt

What changed in pyjwt 2, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-21.

7 breaking17 security1 new APIs and options2 behavior and defaults1 tooling7 fixes and other

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

@unstale/cli 0.2.1 on npm

pyjwt 235 changes

Breaking changes 7

  • The encoder adds b64 to crit, and the decoder rejects b64=false tokens that omit it.

    2.13.0release notes

  • Requires the compact-form payload segment to be empty for detached-payload JWS and no longer decodes that unused segment.

    2.13.0release notessecurity advisory

  • Rejects JWK-shaped JSON strings as HMAC keys, preventing algorithm confusion when symmetric and asymmetric algorithms are both allowed.

    2.13.0release notessecurity advisory

  • Empty HMAC keys now raise InvalidKeyError instead of being accepted with a warning.

    2.13.0release notes

  • Verification now requires the token header alg to match the algorithm bound to the PyJWK.

    2.13.0release notessecurity advisory

  • Rejects URIs whose scheme is not http or https, preventing access through unintended schemes.

    2.13.0release notessecurity advisory

  • The RFC 7515 crit header parameter is validated, affecting how tokens with critical header parameters are handled.

    2.12.0release notessecurity advisory

Security 17

  • PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion

    2.15.0security advisory

  • PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False)

    2.15.0security advisory

  • PyJWT accepts public JWK containers as HMAC secrets

    2.14.0security advisory

  • PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard

    2.14.0security advisory

  • PyJWT BOM Bypass

    2.14.0security advisory

  • PyJWT: Malformed RSA JWK aborts parsing of an entire JWK Set

    2.14.0security advisory

  • PyJWT: Non-canonical signature segments enable raw-token revocation bypass

    2.14.0security advisory

  • PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard

    2.14.0security advisory

  • PyJWT: PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation

    2.14.0security advisory

  • PyJWT: PyJWKClient follows redirects when fetching JWKS

    2.14.0security advisory

  • PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524)

    2.14.0security advisory

  • PyJWT: ReDoS vulnerability when calling the is_pem_format function.

    2.14.0security advisory

  • PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token header

    2.14.0security advisory

  • A failed fetch no longer evicts valid cached JWK sets, so transient endpoint errors do not cause application-wide authentication failure.

    2.13.0release notessecurity advisory

  • Per-call options are forwarded to signature verification, so enforce_minimum_key_length now takes effect when passed to decode.

    2.13.0release notes

  • Keys are validated against the allowed types for their algorithm family.

    2.11.0release notes

  • Issuer claim type checks are added.

    2.11.0release notes

New APIs and options 1

  • PyJWKSet gains an iterator, allowing developers to iterate over its keys.

    2.11.0release notes

Behavior and default changes 2

  • Encoding without an explicit algorithm now uses the PyJWK algorithm.

    2.12.0release notes

  • Passing algorithm=None is mapped to the "none" algorithm.

    2.11.0release notes

Tooling 1

  • The PyJWKSet.keys annotation was updated for pyright.

    2.12.0release notes

Fixes and other changes 7

  • Adds typing_extensions as a dependency for Python versions below 3.11.

    2.12.1release notes

  • HTTPError is closed to prevent a ResourceWarning on Python 3.14.

    2.12.0release notes

  • PyJWK no longer stores a reference to the algorithms dict.

    2.12.0release notes

  • The options parameter's typing and logic are improved in decode and decode_complete.

    2.11.0release notes

  • The lifespan and timeout type annotations use float instead of int.

    2.11.0release notes

  • The method's type annotation is corrected.

    2.11.0release notes

  • PyJWT adds support for Python 3.14.

    2.11.0release notes