BUG(isJWT): validate decoded header and payload as JSON objects#2677

Open

Kartikeya-guthub wants to merge 11 commits intovalidatorjs:masterfrom

Kartikeya-guthub:fix/isJWT-json-validation

Commits on Mar 7, 2026

fix(isJWT): validate Base64url-decoded header and payload are JSON objects (fixes #2511)
Kartikeya-guthub
committed
test(isJWT)
Kartikeya-guthub
committed
fix(isJWT):
Kartikeya-guthub
committed
test(isJWT): add cases to cover line 12 and line 34 branches
Kartikeya-guthub
committed
fix(isJWT): replace Buffer.from with cross-env decode helper; add unsecured JWT valid test
Kartikeya-guthub
committed
chore(isJWT): ignore cross-env fallback from coverage
Kartikeya-guthub
committed
fix(isJWT): replace padStart, scope istanbul ignore, fix test padding
Kartikeya-guthub
committed
chore(isJWT): add istanbul ignore for old Node Buffer fallback
Kartikeya-guthub
committed
chore(isJWT): ignore Buffer undefined else branch
Kartikeya-guthub
committed
fix(isJWT): require non-empty signature unless alg is none (RFC 7519 Section 6)
Kartikeya-guthub
committed
revert(isJWT): remove alg check for empty signature, simplify header validation
Kartikeya-guthub
committed