Is firebase/php-jwt 6.7 vulnerable?

Composer · 1 release from 6.7.0 to 6.7.0 · latest firebase/php-jwt is 7.2.1 · checked 2 Nov 2026

Yes: 1 known advisory

Yes. firebase/php-jwt 6.7.0, the last 6.7 release, is affected by 1 known security advisory (1 low), including CVE-2025-45769. Upgrade to 7.0.0 or later to fix all of them.

Upgrade with:composer require firebase/php-jwt:^7.0.0

Is your project affected?

Private repo? Upload its lockfile instead, or connect GitHub to check every repo.

Advisories affecting firebase/php-jwt 6.7.0

  • LowCVE-2025-45769GHSA-2x45-7fc3-mxwq31 Jul 2025

    php-jwt contains weak encryption

    Affected
    <7.0.0
    Fixed in
    7.0.0

Which of your client projects are still on firebase/php-jwt 6.7?

NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact firebase/php-jwt version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

Other firebase/php-jwt versions

Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the Composer registry. Refreshed daily.