node-jws is a Node.js implementation of JSON Web Signatures (JWS). It lets you synchronously sign and verify JWS tokens, or use streaming SignStream and VerifyStream APIs, supporting common HMAC, RSA, RSA-PSS, ECDSA, and the “none” algorithm (with the spec except X.509 certificate chain signing and verifying).
Project status
- Maintenance status: The GitHub upstream shows a push on 2026-06-25, suggesting ongoing maintenance, though the newest tagged updates listed here are from 2025-12-04.
- Updates cadence (as evidenced here): There are multiple updates clustered on 2025-12-04 (v3.2.3 and v4.0.1 same day), but the next older detailed entry is v4.0.0 from 2019-12-17, so the observable release cadence in this snippet is irregular.
AI summary generated
Recent updates
v3.2.3
v3.2.3 updates HMAC signing and verification logic in the streaming APIs and bumps the JWA dependency to 1.4.2. It also adds tests around edge cases for streaming HMAC with empty secrets (empty string and empty buffer).
Securityv4.0.1
v4.0.1 updates streaming JWS signing and verification to address GHSA-869p-cjfg-cm3x and bumps the JWA dependency to 2.0.1. The documented intent is to require a secret when using HMAC algorithms, and to improve compatibility for Node >= 25.
BreakingSecurityv4.0.0
Release v4.0.0 contains minimal visible changes in the tracked files, with the only substantive change being a dependency bump from jwa ^1.4.1 to jwa ^2.0.0. The release notes section is empty, so any behavior changes introduced by the dependency update are not documented.
Breakingv3.2.2
Release v3.2.2 updates the package version and bumps the runtime dependency on `jwa`. No release notes were provided, so there is nothing documented about what changed beyond the diffed metadata and dependency version.
v3.2.1
This release (v3.2.1) updates the package version and extends the set of supported JWS signature algorithms. No release notes were provided, so changes must be inferred from the code diff.
Featuresv3.2.0
This release (v3.2.0) updates the project version, bumps the core crypto dependency (jwa), and refreshes the README. There are no release notes provided, so the only confirmed changes from the diff are dependency/CI updates and documentation updates reflecting newly listed algorithms.
v3.1.5
v3.1.5 was published on 2018-05-14. The publisher did not provide any release notes, so the release contents, potential API changes, and fixes are not documented in this source.