Download Latest Version 4.1.7 source code.zip (376.7 kB)
Email in envelope

Get an email when there's a new version of PHP JWT Framework

Home / 4.0.7
Name Modified Size InfoDownloads / Week
Parent folder
4.0.7 source code.tar.gz 2026-06-06 122.8 kB
4.0.7 source code.zip 2026-06-06 367.0 kB
README.md 2026-06-06 757 Bytes
Totals: 3 Items   490.5 kB 1

Release Notes for 4.0.7

Security patch release (4.0.x).

Brings the security fixes up from 3.4.x (#652):

  • PBES2-HS*+A*KW — bounded p2c (PBKDF2 iteration count) to prevent a CPU-amplification denial of service. (GHSA-3prj-6hqw-cm82)
  • ChaCha20-Poly1305 key encryption — Poly1305 authentication tag now emitted and verified. (GHSA-6vvh-pxr4-25r7)
  • RSA1_5 — constant-time implicit rejection (Bleichenbacher mitigation). (GHSA-5739-39v2-5754)
  • JWSalg read only from the integrity-protected header (algorithm-confusion mitigation). (GHSA-jc38-x7x8-2xc8)

Also included:

Source: README.md, updated 2026-06-06