Node 24 compatibility

[benfosterlitmos]

Description

jsonwebtoken doesn't work with Node 24. The buffer-equal-constant-time library throws an error:

Cannot read properties of undefined (reading 'prototype')

at

var origSlowBufEqual = SlowBuffer.prototype.equal;

buffer-equal-constant-time is a nested dep: jsonwebtoken > jws > jwa > buffer-equal-constant-time

Reproduction

Initialize a new Node project and install jsonwebtoken.

Run the following JS using Node 24.0.0

import jsonwebtoken from "jsonwebtoken";

jsonwebtoken.sign({ text: "test" }, "ABC");

Result:

var origSlowBufEqual = SlowBuffer.prototype.equal;
                                  ^

TypeError: Cannot read properties of undefined (reading 'prototype')
    at Object.<anonymous> (/Users/user/testnode24/node_modules/buffer-equal-constant-time/index.js:37:35)
    at Module._compile (node:internal/modules/cjs/loader:1734:14)
    at Object..js (node:internal/modules/cjs/loader:1899:10)
    at Module.load (node:internal/modules/cjs/loader:1469:32)
    at Module._load (node:internal/modules/cjs/loader:1286:12)
    at TracingChannel.traceSync (node:diagnostics_channel:322:14)
    at wrapModuleLoad (node:internal/modules/cjs/loader:235:24)
    at Module.require (node:internal/modules/cjs/loader:1491:12)
    at require (node:internal/modules/helpers:135:16)
    at Object.<anonymous> (/Users/user/testnode24/node_modules/jwa/index.js:1:19)

Node.js v24.0.0

Environment

• jsonwebtoken 9.0.2
• Node 24.0.0
• MacOS Sequoia

Running in Node 22 works without any issues.

[panva]

Both runtime-deprecation and EOL of said Node.js API happened in the same major, that shouldn't have happened. nodejs/node#58211

[panva]

I've tagged auth0/node-jwa#52 internally to work around the deprecation and unintended removal (that nodejs/node#58211 will also resolve)

[panva]

We've released patched versions of the jwa transitive dependency. These releases take care of not using the deprecated code when crypto.timingSafeEqual() is available (while still using it when run in legacy codebase with EOL Node.js versions where it wasn't available).

Running npm upgrade jwa (or whichever package manager alternative you happen to use) will pick those patched versions up and fix the issue for you.

I will leave this issue open to hopefully avoid new issues from being open and will comment again when a Node.js release with the deprecated (but not removed) functionality is available.

Edit: Node.js v24.0.1 was released on 2025-05-08 which reverts the problematic removal, it will still be removed in v25.x in October, but with the release of jwa@1.4.2 and jwa@2.0.1 these APIs are no longer in use so long as you upgrade your dependency tree, e.g. via npm upgrade jwa.

[mvantellingen]

Nice to see how quickly this is resolved, however I don't think it's possible to update the jwa dependency. It seems that jsonwebtoken@9.0.2 has a dependency on jws ^3.2.2, which depends on jwa ^1.4.1. So it doesn't seem possible to update jwa to the latest version (2.0.1).

[panva]

Nice to see how quickly this is resolved, however I don't think it's possible to update the jwa dependency. It seems that jsonwebtoken@9.0.2 has a dependency on jws ^3.2.2, which depends on jwa ^1.4.1. So it doesn't seem possible to update jwa to the latest version (2.0.1).

We did a release for both 1.x and 2.x major version release lines of jwa. They're both visible on npm and github and v1.4.2 does get picked up during dependency tree upgrades since it is within the declared semver range.

[kirrg001]

it will still be removed in v25.x in October

Yes v25 rc.1 is failing because of that issue.

@instana/collector: /artifacts/node_modules/buffer-equal-constant-time/index.js:37
@instana/collector: var origSlowBufEqual = SlowBuffer.prototype.equal;
@instana/collector: ^
@instana/collector: TypeError: Cannot read properties of undefined (reading 'prototype')
@instana/collector: at Object. (/artifacts/node_modules/buffer-equal-constant-time/index.js:37:35)

[panva]

@kirrg001 With the release of jwa@1.4.2 and jwa@2.0.1 the removed APIs are no longer in use

[kirrg001]

Yeah thank you. I've noticed our lock file was on 2.0.0 for google pub sub parent package. This should resolve the error.
jws could pin the min version to ^2.0.1 (and for 1.x to ^1.4.2), so everyone would get an auto-update.

[panva]

How would anyone get an auto-update? Assuming you can run npm upgrade jws to upgrade jws you might as well just run npm upgrade jwa.

[Aluisio]

Node 24 is approaching the LTS release. Can we upgrade or will the library be incompatible with Node 24?