jwt 2.10.2 → 2.10.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0cae4dcfd78806b4eb8192b16880e1ebeafa8651400296c9ca955f5b91abe9ab
-  data.tar.gz: a5a024f58f196d355eb004aa39be6f2d3b1e5fbf1219cac78b4d315833fd9d3f
+  metadata.gz: 014554dde95af535e1c1b84fb4532d6a69ecf2391baaf21c69bbabefb91e4d1c
+  data.tar.gz: f309fd328b353d1ebc2f96e4938cd3d82bf1cc88ab3f94fbadb30027c98751d7
 SHA512:
-  metadata.gz: 4fa464f652e42bd8d70243a6dd8cb8e9ad72d285116580cf802108328c20b35b274ea7e371764855fcc8b620507a7b5f9bdac0632d270bff0ad5e4ce773d0352
-  data.tar.gz: 938d9d141e35b29b94f9fe64fe07a4c87a279e2120236873d2fd5c9ca5e2bd183c4fc3123eb3c9a46d18d6c60df5271b9e2431345dbd87035dd009c07e8aa6f5
+  metadata.gz: f6c6fc5f6ec227884cb6cbef16cf91063c29e81a58b3a0186b50dce86b66ea769bac89742e030f4db59097e67d263819bf3d73a6e1b3ca337eec65dc6219bedb
+  data.tar.gz: 8c62212530a0f8bb6405ed923a0bcfb50375ed63e51f5fe3570d59f7208a6d018434d2de8fefb932b1a2401920b615a69adc5b072be1238f7bf849fda823f26a

data/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## [v2.10.3](https://github.com/jwt/ruby-jwt/tree/v2.10.3) (2026-05-22)
+
+[Full Changelog](https://github.com/jwt/ruby-jwt/compare/v2.10.2...v2.10.3)
+
+**Fixes and enhancements:**
+
+- Backport: Reject `nil` and empty HMAC keys when signing and verifying ([CVE-2026-45363](https://www.cve.org/CVERecord?id=CVE-2026-45363) / [GHSA-c32j-vqhx-rx3x](https://github.com/jwt/ruby-jwt/security/advisories/GHSA-c32j-vqhx-rx3x)) [#725](https://github.com/jwt/ruby-jwt/pull/725) ([@royzwambag](https://github.com/royzwambag))
+
 ## [v2.10.2](https://github.com/jwt/ruby-jwt/tree/v2.10.2) (2025-06-29)
 
 [Full Changelog](https://github.com/jwt/ruby-jwt/compare/v2.10.1...v2.10.2)

data/lib/jwt/jwa/hmac.rb

@@ -16,18 +16,15 @@ module JWT
       end
 
       def sign(data:, signing_key:)
-        signing_key ||= ''
-        raise_verify_error!('HMAC key expected to be a String') unless signing_key.is_a?(String)
+        ensure_valid_key!(signing_key)
 
         OpenSSL::HMAC.digest(digest.new, signing_key, data)
-      rescue OpenSSL::HMACError => e
-        raise_verify_error!('OpenSSL 3.0 does not support nil or empty hmac_secret') if signing_key == '' && e.message == 'EVP_PKEY_new_mac_key: malloc failure'
-
-        raise e
       end
 
       def verify(data:, signature:, verification_key:)
-        SecurityUtils.secure_compare(signature, sign(data: data, signing_key: verification_key))
+        ensure_valid_key!(verification_key)
+
+        SecurityUtils.secure_compare(signature, OpenSSL::HMAC.digest(digest.new, verification_key, data))
       end
 
       register_algorithm(new('HS256', OpenSSL::Digest::SHA256))
@@ -38,6 +35,11 @@ module JWT
 
       attr_reader :digest
 
+      def ensure_valid_key!(key)
+        raise_verify_error!('HMAC key expected to be a String') unless key.is_a?(String)
+        raise_verify_error!('HMAC key cannot be empty') if key.empty?
+      end
+
       # Copy of https://github.com/rails/rails/blob/v7.0.3.1/activesupport/lib/active_support/security_utils.rb
       # rubocop:disable Naming/MethodParameterName, Style/StringLiterals, Style/NumericPredicate
       module SecurityUtils

data/lib/jwt/version.rb

@@ -16,7 +16,7 @@ module JWT
   module VERSION
     MAJOR = 2
     MINOR = 10
-    TINY  = 2
+    TINY  = 3
     PRE   = nil
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join('.')

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: jwt
 version: !ruby/object:Gem::Version
-  version: 2.10.2
+  version: 2.10.3
 platform: ruby
 authors:
 - Tim Rudat
@@ -194,7 +194,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/jwt/ruby-jwt/issues
-  changelog_uri: https://github.com/jwt/ruby-jwt/blob/v2.10.2/CHANGELOG.md
+  changelog_uri: https://github.com/jwt/ruby-jwt/blob/v2.10.3/CHANGELOG.md
   rubygems_mfa_required: 'true'
 rdoc_options: []
 require_paths:
@@ -210,7 +210,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.7
+rubygems_version: 4.0.10
 specification_version: 4
 summary: JSON Web Token implementation in Ruby
 test_files: []