node-jws is a Node.js implementation of JSON Web Signatures (JWS). It lets you synchronously sign and verify JWS tokens, or use streaming SignStream and VerifyStream APIs, supporting common HMAC, RSA, RSA-PSS, ECDSA, and the “none” algorithm (with the spec except X.509 certificate chain signing and verifying).
Project status
- Maintenance status: Likely actively maintained, with recent updates in 2025 (v3.2.3, v4.0.1) and the most recent upstream push on 2026-06-25, though the last tagged version shown here is from 2025-12-04.
- Update cadence: Evidence suggests moderate cadence, with a cluster of updates in early December 2025 (v3.2.3 and v4.0.1), and then a gap of roughly 8 months to the next confirmed activity (an upstream push in 2026, but no new tagged version provided here).
AI summary generated
Recent updates
v3.2.3
v3.2.3 updates HMAC signing and verification logic in the streaming APIs and bumps the JWA dependency to 1.4.2. It also adds tests around edge cases for streaming HMAC with empty secrets (empty string and empty buffer).
Securityv4.0.1
v4.0.1 updates streaming JWS signing and verification to address GHSA-869p-cjfg-cm3x and bumps the JWA dependency to 2.0.1. The documented intent is to require a secret when using HMAC algorithms, and to improve compatibility for Node >= 25.
BreakingSecurityv4.0.0
Release v4.0.0 contains minimal visible changes in the tracked files, with the only substantive change being a dependency bump from jwa ^1.4.1 to jwa ^2.0.0. The release notes section is empty, so any behavior changes introduced by the dependency update are not documented.
Breakingv3.2.2
Release v3.2.2 updates the package version and bumps the runtime dependency on `jwa`. No release notes were provided, so there is nothing documented about what changed beyond the diffed metadata and dependency version.
v3.2.1
This release (v3.2.1) updates the package version and extends the set of supported JWS signature algorithms. No release notes were provided, so changes must be inferred from the code diff.
Featuresv3.2.0
This release (v3.2.0) updates the project version, bumps the core crypto dependency (jwa), and refreshes the README. There are no release notes provided, so the only confirmed changes from the diff are dependency/CI updates and documentation updates reflecting newly listed algorithms.
v3.1.5
v3.1.5 was published on 2018-05-14. The publisher did not provide any release notes, so the release contents, potential API changes, and fixes are not documented in this source.