node-jwa is a Node.js library that implements JSON Web Algorithms, focused on the algorithms needed for JSON Web Signatures (JWS). It provides sign and verify helpers for common JWS signature and MAC algorithms such as HS256, RS256, PS256, and ES256, including none, returning base64url-encoded signatures for JWS use.
Project status
- The source shows evidence of prior active maintenance (notable security-related
timingSafeEqualconstant-time comparison updates), but based on the provided update tags, the most recent published updates are from 2025-05-07, about 14 months before today (2026-08-13), so it appears quiet or in maintenance mode. - Update cadence appears irregular historically, with major changes years apart (for example, v2.0.0 in 2019, then v2.0.1 and v1.4.2 in 2025). The upstream repository had a push on 2026-06-25, but no corresponding tagged “updates” are shown in the provided data.
AI summary generated
Recent updates
v1.4.2
v1.4.2 updates the constant-time buffer comparison used during JWA HMAC verification. The release notes state it replaces `buffer-equal-constant-time` with Node's `crypto.timingSafeEqual`.
Securityv2.0.1
Release v2.0.1 updates JWA to use Node.js `crypto.timingSafeEqual` for constant-time signature comparison, with a fallback to the `buffer-equal-constant-time` package when `timingSafeEqual` is unavailable. The main functional change is in the HMAC verifier path, where the equality check was swapped to the new implementation.
Securityv2.0.0
Release v2.0.0 contains a small but user-visible behavioral change: the JWA algorithm name argument is no longer treated as case-insensitive. Release notes were not provided by the publisher, so the actual behavior change is only observable in the code diff and documentation/tests.
Breakingv1.4.1
v1.4.1 contains a small cryptographic change to the RSA-PSS (PS) signer and verifier logic, plus a corresponding adjustment to the OpenSSL-based test. Release notes were not provided, so the change described below is not documented externally.
Breakingv1.4.0
Release v1.4.0 has no published release notes in the provided data. The code diff shows a validation refactor in index.js that adds Node.js crypto.KeyObject support (notably for HMAC secrets and RSA-PSS keys), plus a larger RFC7515-based test suite and small test runner updates.
Featuresv1.3.0
Release v1.3.0 adds support for passing Node.js crypto KeyObject instances as public and private keys to the JWA sign and verify implementations, gated by availability of crypto.createPublicKey. It also bumps the ecdsa-sig-formatter dependency and updates tests to cover KeyObject usage, plus minor repo/test tooling changes.
Featuresv1.2.0
v1.2.0 adds support for RSASSA-PSS (RSA-PSS) JWS algorithms, specifically ps256, ps384, and ps512. It also expands test coverage and CI Node.js versions to validate RSA-PSS behavior and OpenSSL interoperability.
Featuresv1.1.6
Release v1.1.6 was published, but no release notes were provided by the publisher. There is not enough information here to identify new features, bug fixes, breaking changes, security, or dependency updates.