All pull requests

Pull requests

• Skip failed public key parse for HMAC string secrets

  #1047·Hashim1999164 opened Sep 18, 2026·

  ·
  1

• fix: reject a non-numeric clockTolerance instead of silently ignoring it

  #1045·afonsojanu opened Sep 3, 2026·

  ·
  1

• fix(verify): bound RegExp "audience" matching against an oversized aud claim (ReDoS)

  #1044·yfwmaniish opened Sep 1, 2026·

  ·
  1

• fix: respect an iat of 0 instead of overwriting it with the current time (#874)

  #1043·jaideeppyne opened Aug 19, 2026·

  ·
  1

• fix(verify): reject tokens with an unsupported "crit" header parameter

  #1041·ArockiaRajamanickam opened Aug 2, 2026·

  ·
  1

• docs: warn that RegExp audiences should be anchored

  #1040·Hashim1999164 opened Jul 22, 2026·

  ·
  1

• fix(verify): add upper bound of 300 seconds for clockTolerance option

  #1039·Pranav18M opened Jun 29, 2026·

  ·
  1

• fix(verify): make regexp audience consistent with string audience for tokens without an aud claim

  #1038·spokodev opened Jun 25, 2026·

  ·

• fix(verify): validate clockTolerance is a non-negative number

  #1036·abhu85 opened Jun 22, 2026·

  ·
  1

• docs: fix typo "compatability" → "compatibility" in README

  #1029·premsreelathasugeendran opened May 10, 2026·

  ·
  2

• feat!: update minimum Node.js version to 22

  #1028·gameroman opened May 7, 2026·

  ·

• fix: wrap SyntaxError as JsonWebTokenError for malformed payloads

  #1025·abhu85 opened Apr 29, 2026·

  ·
  2

• fix(deps): remove lodash dependencies

  #1022·gameroman opened Apr 11, 2026·

  ·
  1

  4

• fix: wrap crypto TypeError in JsonWebTokenError for malformed EC/RSA signatures

  #1018·Vansh1811 opened Mar 25, 2026·

  ·
  1

  1

• fix: prevent callback from being called twice on payload conflict

  #1017·abhu85 opened Mar 20, 2026·

  ·
  1

  1

• fix: prevent double callback invocation on payload conflict

  #1016·abhu85 opened Mar 18, 2026·

  ·
  1

• Reject non-finite exp/nbf/iat values and tighten validation

  #1013·AzmeerX opened Mar 16, 2026·

  ·
  1

• replace ms with ms-tiny

  #1012·ofershap opened Feb 26, 2026·

  ·

• Fix #1000: Prevent callback from being called twice on payload claim conflict

  #1011·cobyfrombrooklyn-bot opened Feb 25, 2026·

  ·
  1

• Add documentation to functions

  #1008·borisonekenobi opened Dec 18, 2025·

  ·
  9

• feat: add options.type

  #1006·ewan-chalmers opened Nov 12, 2025·

  ·

• Update README.md to clarify expiresIn usage

  #1005·SidRao333 opened Nov 11, 2025·

  ·

• fix(sign): prevent double callback when payload already has a property

  #1002·maishivamhoo123 opened Nov 7, 2025·

  ·
  1

• fix: update jws to 4.0.0 to resolve SlowBuffer deprecation

  #1001·l7aromeo opened Nov 1, 2025·

  ·
  2

• Create node.js.yml

  #999·kayphubatphokamsky-netizen opened Aug 26, 2025·

  ·