Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

[Firebase v14] App Check verifyToken crashes with ERR_REQUIRE_ESM (jwks-rsa@4 require()s ESM-only jose@6)

Abierto
#3,181 2 comentarios 5 reacciones 1 asignado Ver en GitHub

@jonathanedey ya está trabajando en esto.

Desde el 17/6/2026.

Evaluación

Este issue todavía no se ha evaluado.

Descripción

api: appcheck

Summary

getAppCheck().verifyToken() throws ERR_REQUIRE_ESM in a CommonJS/serverless runtime. The transitive dep jwks-rsa@4.0.1 does const jose = require('jose') but declares jose@^6.1.3, and jose@6 is ESM-only, so the require() is a hard Node error.

Error

Error [ERR_REQUIRE_ESM]: require() of ES Module
  node_modules/.pnpm/jose@6.2.3/node_modules/jose/dist/webapi/index.js
  from node_modules/.pnpm/jwks-rsa@4.0.1/node_modules/jwks-rsa/src/utils.js
  not supported.

Root cause (verified)

  1. firebase-admin@14.0.0 App Check verification depends on jwks-rsa@4.0.1.
  2. jwks-rsa@4.0.1 declares "jose": "^6.1.3" and loads it via CommonJS in src/utils.js: 
    const jose = require('jose');
  3. jose@6.2.3 is ESM-only ("type": "module", no require export condition).
  4. Node refuses require() of an ESM module, so any path reaching App Check JWKS verification crashes.

jwks-rsa@4.0.1 is internally inconsistent: a CommonJS require('jose') paired with a jose range whose only satisfying versions are ESM-only. firebase-admin ships this combination. It only uses jose.importJWK and jose.exportSPKI, which are API-identical across jose 4/5/6.

Why production only

Dev uses an ESM-capable loader, so the import resolves via interop. In a production CommonJS/serverless bundle (firebase-admin is externalized and loaded with require()), the require()-of-ESM hits the hard error.

Environment

  • firebase-admin: 14.0.0
  • jwks-rsa: 4.0.1 (transitive)
  • jose resolved: 6.2.3 (ESM-only)
  • Node.js 20+, CommonJS context, serverless (Vercel), Next.js 16, pnpm 11

Expected

App Check verification works in a CommonJS/serverless runtime without manual dependency overrides.

Suggested fix

Move jwks-rsa to a version that loads jose via dynamic import(), or constrain jose to a dual CJS/ESM build (^4/^5), or pin/patch jwks-rsa's jose in firebase-admin.

Workaround (consumer side)

# pnpm-workspace.yaml
overrides:
  jwks-rsa>jose: "4.15.9"
Lenguaje dominante
TypeScript
Estrellas
1.7k
Forks
419
Merge medio
4 d 20 h
PR fusionados (30 d)
16

Guía de contribución

Abrir la guía de contribución

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de firebase/firebase-admin-node

Todos los issues de firebase/firebase-admin-node

Issues similares

Más issues de TypeScript

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.