Is github.com/golang-jwt/jwt safe to use?

github.com/golang-jwt/jwt has 2 known vulnerabilities on the latest version (v3.2.2+incompatible). DepScope rates its health at 40/100 (high risk).

What is the latest version of github.com/golang-jwt/jwt?

The latest version of github.com/golang-jwt/jwt is v3.2.2+incompatible, released 2021-07-30.

Does github.com/golang-jwt/jwt have known vulnerabilities?

Yes. github.com/golang-jwt/jwt has 2 known vulnerabilities. See depscope.dev/pkg/go/github.com/golang-jwt/jwt for details.

Is github.com/golang-jwt/jwt deprecated?

No, github.com/golang-jwt/jwt is actively maintained. Latest release: v3.2.2+incompatible (2021-07-30).

What are alternatives to github.com/golang-jwt/jwt?

DepScope has no curated alternatives for github.com/golang-jwt/jwt at this time.

What license does github.com/golang-jwt/jwt use?

github.com/golang-jwt/jwt is licensed under MIT.

github.com/golang-jwt/jwt

govv3.2.2+incompatible

Go implementation of JSON Web Tokens (JWT).

License MITpermissive16 versions120 maintainers0 deps9,046 weekly dl

golang-jwt/jwt

/ 100

Health

update required

github.com/golang-jwt/[email protected]+incompatible has vulnerabilities — update to latest

Update to >= 5.2.2 to fix known vulnerabilities

1 high severity vulnerabilities

Health breakdown0 – 100

0/25

maintenance

6/20

popularity

20/25

security

9/15

maturity

5/15

community

Vulnerabilities

1 high1 low

Advisories (2)

Severity	ID	Summary	Fixed in
high	CVE-2025-30204	jwt-go allows excessive memory allocation during header parsing	4.5.2
unknown	CVE-2025-30204	Excessive memory allocation during header parsing in github.com/golang-jwt/jwt	5.2.2

OSS Scorecard

OpenSSF security posture score

6.5/10

moderate

Maintainer trust

Active maintainers (3m)

6

Contributors (12m)

11

Primary author dominance

41%

GitHub stars

9,036

Health History

Dependency Tree

License Audit

API access

Get this data programmatically — free, no authentication.

curl https://depscope.dev/api/check/go/github.com/golang-jwt/jwt

Last updated · 2021-07-30T20:54:04Z