Node 24 compatibility

Description

jsonwebtoken doesn't work with Node 24. The buffer-equal-constant-time library throws an error:

Cannot read properties of undefined (reading 'prototype')

at

var origSlowBufEqual = SlowBuffer.prototype.equal;

buffer-equal-constant-time is a nested dep: jsonwebtoken > jws > jwa > buffer-equal-constant-time

Reproduction

Initialize a new Node project and install jsonwebtoken.

Run the following JS using Node 24.0.0

import jsonwebtoken from "jsonwebtoken";

jsonwebtoken.sign({ text: "test" }, "ABC");

Result:

var origSlowBufEqual = SlowBuffer.prototype.equal;
                                  ^

TypeError: Cannot read properties of undefined (reading 'prototype')
    at Object.<anonymous> (/Users/user/testnode24/node_modules/buffer-equal-constant-time/index.js:37:35)
    at Module._compile (node:internal/modules/cjs/loader:1734:14)
    at Object..js (node:internal/modules/cjs/loader:1899:10)
    at Module.load (node:internal/modules/cjs/loader:1469:32)
    at Module._load (node:internal/modules/cjs/loader:1286:12)
    at TracingChannel.traceSync (node:diagnostics_channel:322:14)
    at wrapModuleLoad (node:internal/modules/cjs/loader:235:24)
    at Module.require (node:internal/modules/cjs/loader:1491:12)
    at require (node:internal/modules/helpers:135:16)
    at Object.<anonymous> (/Users/user/testnode24/node_modules/jwa/index.js:1:19)

Node.js v24.0.0

Environment

jsonwebtoken 9.0.2
Node 24.0.0
MacOS Sequoia

Running in Node 22 works without any issues.

Both runtime-deprecation and EOL of said Node.js API happened in the same major, that shouldn't have happened. nodejs/node#58211

I've tagged auth0/node-jwa#52 internally to work around the deprecation and unintended removal (that nodejs/node#58211 will also resolve)

We've released patched versions of the jwa transitive dependency. These releases take care of not using the deprecated code when crypto.timingSafeEqual() is available (while still using it when run in legacy codebase with EOL Node.js versions where it wasn't available).

Running npm upgrade jwa (or whichever package manager alternative you happen to use) will pick those patched versions up and fix the issue for you.

I will leave this issue open to hopefully avoid new issues from being open and will comment again when a Node.js release with the deprecated (but not removed) functionality is available.

Edit: Node.js v24.0.1 was released on 2025-05-08 which reverts the problematic removal, it will still be removed in v25.x in October, but with the release of jwa@1.4.2 and jwa@2.0.1 these APIs are no longer in use so long as you upgrade your dependency tree, e.g. via npm upgrade jwa.

Nice to see how quickly this is resolved, however I don't think it's possible to update the jwa dependency. It seems that jsonwebtoken@9.0.2 has a dependency on jws ^3.2.2, which depends on jwa ^1.4.1. So it doesn't seem possible to update jwa to the latest version (2.0.1).

Nice to see how quickly this is resolved, however I don't think it's possible to update the jwa dependency. It seems that jsonwebtoken@9.0.2 has a dependency on jws ^3.2.2, which depends on jwa ^1.4.1. So it doesn't seem possible to update jwa to the latest version (2.0.1).

We did a release for both 1.x and 2.x major version release lines of jwa. They're both visible on npm and github and v1.4.2 does get picked up during dependency tree upgrades since it is within the declared semver range.

it will still be removed in v25.x in October

Yes v25 rc.1 is failing because of that issue.

@instana/collector: /artifacts/node_modules/buffer-equal-constant-time/index.js:37
@instana/collector: var origSlowBufEqual = SlowBuffer.prototype.equal;
@instana/collector: ^
@instana/collector: TypeError: Cannot read properties of undefined (reading 'prototype')
@instana/collector: at Object. (/artifacts/node_modules/buffer-equal-constant-time/index.js:37:35)

@kirrg001

@kirrg001 With the release of jwa@1.4.2 and jwa@2.0.1 the removed APIs are no longer in use

Yeah thank you. I've noticed our lock file was on 2.0.0 for google pub sub parent package. This should resolve the error.
jws could pin the min version to ^2.0.1 (and for 1.x to ^1.4.2), so everyone would get an auto-update.

How would anyone get an auto-update? Assuming you can run npm upgrade jws to upgrade jws you might as well just run npm upgrade jwa.

Node 24 is approaching the LTS release. Can we upgrade or will the library be incompatible with Node 24?

jwa@1.4.2 and jwa@2.0.1 are compatible with Node.js releases where SlowBuffer is EOL.

Sorry, but I don't understand. The version specified in the jws package.json is 3.2.2, which uses jwa version 1.4.1.
I don't understand if the update to node 24 will work automatically or if I'll need to change something.

Node.js 25 has been released, and I encountered the same issue with the "slim" Docker image. Switching the image to "lts-slim" resolved the problem.

I too found it fatally flawed in node 25.0 but it worked in 24.10.0.

Using npm upgrade jwa on Node v25 helped. Version of jwa i got is 1.4.2

Wouldn't it be easier to just release a new version of both the jws (using the correct jwa version) and jsonwebtoken (using the fixed jws version) rather than forcing consumers to fix those transient dependencies?

This is major issue happening to anyone using Node 25, and expecting everyone to land in this issue thread to solve the issue does not sound like a proper way of dealing with it.

Just my 2 cents.

I just updated to Node.js v25.0.0 and encountered the exact same error. Running npm upgrade jwa resolved the issue for me.

Upgrade jwa

Update `jwa` dependency for Node 24+ compatibility (#1906)

For those who use yarn - add this to you package.json

"resolutions": {
    "jwa": "^2.0.1"
 },

fix: add Node.js 25 compatibility via jwa resolution

Seeing the same failure on Node 25 (SlowBuffer removed). Stack: buffer-equal-constant-time -> jwa -> jws -> jsonwebtoken (pulled in via @slack/bolt). Quick workaround: patch buffer-equal-constant-time to fall back to Buffer when SlowBuffer is undefined (and optionally shim Buffer.prototype.equal = Buffer.prototype.equals). Production on Node 24 is fine; local dev on 25 explodes before our code runs. It would be great to ship a fix in a patch release or upstream to buffer-equal-constant-time.

Closed by #1007 which is in 9.0.3

@mbtools

@mbtools , just checking in: Did you forget to close this issue? Does node-jsonwebtoken support Node 24?

I'm not a maintainer and was just connecting the dots. But someone with permissions should close it 😁

auth0/node-jwa#56

Navigation Menu

Repository navigation

Node 24 compatibility #992

Description

Reproduction

Environment

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Node 24 compatibility #992

Description

Description

Reproduction

Environment

Activity

panva commented on May 7, 2025

panva commented on May 7, 2025

panva commented on May 7, 2025

mvantellingen commented on May 7, 2025

panva commented on May 8, 2025

kirrg001 commented on Oct 13, 2025

panva commented on Oct 13, 2025

kirrg001 commented on Oct 13, 2025

panva commented on Oct 13, 2025

Aluisio commented on Oct 13, 2025

panva commented on Oct 13, 2025

Aluisio commented on Oct 13, 2025

Maxou44 commented on Oct 20, 2025

BobFrankston commented on Oct 24, 2025

WojakGra commented on Oct 28, 2025

dpecos commented on Oct 28, 2025

ShahandFahad commented on Oct 29, 2025

pavelbabenko commented on Nov 7, 2025

kvz commented on Dec 1, 2025

mbtools commented on Dec 12, 2025

bendiknesbo commented on Mar 13, 2026

mbtools commented on Mar 13, 2026

gameroman commented on Apr 28, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions