Is firebase/php-jwt 2.0 vulnerable?

Composer · 1 release from 2.0.0 to 2.0.0 · latest firebase/php-jwt is 7.2.1 · checked 2 Nov 2026

Yes: 2 known advisories

Yes. firebase/php-jwt 2.0.0, the last 2.0 release, is affected by 2 known security advisories (1 critical, 1 low), including CVE-2021-46743, CVE-2025-45769. Upgrade to 7.0.0 or later to fix all of them.

Upgrade with:composer require firebase/php-jwt:^7.0.0

Is your project affected?

Private repo? Upload its lockfile instead, or connect GitHub to check every repo.

Advisories affecting firebase/php-jwt 2.0.0

  • LowCVE-2025-45769GHSA-2x45-7fc3-mxwq31 Jul 2025

    php-jwt contains weak encryption

    Affected
    <7.0.0
    Fixed in
    7.0.0
  • CriticalCVE-2021-46743GHSA-8xf4-w7qw-pjjw30 Mar 2022

    Firebase PHP-JWT key/algorithm type confusion

    Affected
    <6.0.0
    Fixed in
    6.0.0

Which of your client projects are still on firebase/php-jwt 2.0?

NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact firebase/php-jwt version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

Other firebase/php-jwt versions

Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the Composer registry. Refreshed daily.