node-jwa is a Node.js library that implements JSON Web Algorithms, focused on the algorithms needed for JSON Web Signatures (JWS). It provides sign and verify helpers for common JWS signature and MAC algorithms such as HS256, RS256, PS256, and ES256, including none, returning base64url-encoded signatures for JWS use.
Project status
- The GitHub upstream shows an additional push on 2026-06-25, which suggests the repository is still being actively worked on, even though the provided published version update summaries end at 2025-05.
- Apparent update cadence is low for published versions: there were two related security-focused updates in 2025-05 (v1.4.2 and v2.0.1), after a long gap since the last summarized major update in 2019-12 (v2.0.0).
AI summary generated
Recent updates
v1.4.2
v1.4.2 updates the constant-time buffer comparison used during JWA HMAC verification. The release notes state it replaces `buffer-equal-constant-time` with Node's `crypto.timingSafeEqual`.
Securityv2.0.1
Release v2.0.1 updates JWA to use Node.js `crypto.timingSafeEqual` for constant-time signature comparison, with a fallback to the `buffer-equal-constant-time` package when `timingSafeEqual` is unavailable. The main functional change is in the HMAC verifier path, where the equality check was swapped to the new implementation.
Securityv2.0.0
Release v2.0.0 contains a small but user-visible behavioral change: the JWA algorithm name argument is no longer treated as case-insensitive. Release notes were not provided by the publisher, so the actual behavior change is only observable in the code diff and documentation/tests.
Breakingv1.4.1
v1.4.1 contains a small cryptographic change to the RSA-PSS (PS) signer and verifier logic, plus a corresponding adjustment to the OpenSSL-based test. Release notes were not provided, so the change described below is not documented externally.
Breakingv1.4.0
Release v1.4.0 has no published release notes in the provided data. The code diff shows a validation refactor in index.js that adds Node.js crypto.KeyObject support (notably for HMAC secrets and RSA-PSS keys), plus a larger RFC7515-based test suite and small test runner updates.
Featuresv1.3.0
Release v1.3.0 adds support for passing Node.js crypto KeyObject instances as public and private keys to the JWA sign and verify implementations, gated by availability of crypto.createPublicKey. It also bumps the ecdsa-sig-formatter dependency and updates tests to cover KeyObject usage, plus minor repo/test tooling changes.
Featuresv1.2.0
v1.2.0 adds support for RSASSA-PSS (RSA-PSS) JWS algorithms, specifically ps256, ps384, and ps512. It also expands test coverage and CI Node.js versions to validate RSA-PSS behavior and OpenSSL interoperability.
Featuresv1.1.6
Release v1.1.6 was published, but no release notes were provided by the publisher. There is not enough information here to identify new features, bug fixes, breaking changes, security, or dependency updates.