diff --git a/.changeset/protect-ffi-jsonwebtoken-cve.md.deferred b/.changeset/protect-ffi-jsonwebtoken-cve.md.deferred
new file mode 100644
index 000000000..8693f8e97
--- /dev/null
+++ b/.changeset/protect-ffi-jsonwebtoken-cve.md.deferred
@@ -0,0 +1,5 @@
+---
+'@cipherstash/protect-ffi': patch
+---
+
+Bump `cipherstash-client`, `cts-common`, `stack-auth`, and `stack-profile` to 0.42.2, which moves the transitive `jsonwebtoken` dependency from 9.3.1 to 10.4.0, resolving [CVE-2026-25537](https://github.com/advisories/GHSA-h395-gr6q-cpjc) (a JWT claim-validation type-confusion bug that could allow bypassing `nbf`/`exp` checks). No API changes.
diff --git a/packages/protect-ffi/Cargo.lock b/packages/protect-ffi/Cargo.lock
index 0f3132109..369191800 100644
--- a/packages/protect-ffi/Cargo.lock
+++ b/packages/protect-ffi/Cargo.lock
@@ -516,9 +516,9 @@ dependencies = [
 
 [[package]]
 name = "cipherstash-client"
-version = "0.42.0"
+version = "0.42.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6c8714a2997ab5a8cc2c871f01dcae9ff7c6b342ed51c5c0d7c8edd4d954c9d1"
+checksum = "59857c1279c8799ce67edde5f300b5decae5d0075b4c8f53d864a0a7ec8a5d01"
 dependencies = [
  "aes-gcm-siv",
  "anyhow",
@@ -577,9 +577,9 @@ dependencies = [
 
 [[package]]
 name = "cipherstash-config"
-version = "0.42.0"
+version = "0.42.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "56cde3aaa5e2916a40530932f142c37ad6202835a6d221ce6c46fc14bfec8fc5"
+checksum = "b94efb31c4b6cc951f2ed2c2a953393ba34136c37c5ddd022a8da732f174e532"
 dependencies = [
  "bitflags",
  "serde",
@@ -589,9 +589,9 @@ dependencies = [
 
 [[package]]
 name = "cipherstash-core"
-version = "0.42.0"
+version = "0.42.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1946988e0b7f9de259d85b10c9c1fd7e1327751103b808c2c6e930b9a87c25c9"
+checksum = "bef863de8a96e98320a2cd49b36f8235cfcc5f2fc40fdb2c05e31dddf598512f"
 dependencies = [
  "getrandom 0.2.17",
  "hmac",
@@ -818,9 +818,9 @@ dependencies = [
 
 [[package]]
 name = "cts-common"
-version = "0.42.0"
+version = "0.42.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fe2acdda527057d48061433ace5378d8452f10d6787f78e0e69b1cddacc57082"
+checksum = "576c82618990e693abe4dfbd06dada0bcb45884a4514405851eec6d82818f52c"
 dependencies = [
  "arrayvec",
  "base32",
@@ -1906,17 +1906,20 @@ dependencies = [
 
 [[package]]
 name = "jsonwebtoken"
-version = "9.3.1"
+version = "10.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a87cc7a48537badeae96744432de36f4be2b4a34a05a5ef32e9dd8a1c169dde"
+checksum = "eba32bfb4ffdeaca3e34431072faf01745c9b26d25504aa7a6cf5684334fc4fc"
 dependencies = [
+ "aws-lc-rs",
  "base64",
+ "getrandom 0.2.17",
  "js-sys",
  "pem",
- "ring",
  "serde",
  "serde_json",
+ "signature",
  "simple_asn1",
+ "zeroize",
 ]
 
 [[package]]
@@ -3296,6 +3299,15 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "signature"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77549399552de45a898a580c1b41d445bf730df867cc44e6c0233bbc4b8329de"
+dependencies = [
+ "rand_core 0.6.4",
+]
+
 [[package]]
 name = "simd-adler32"
 version = "0.3.8"
@@ -3370,9 +3382,9 @@ checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
 
 [[package]]
 name = "stack-auth"
-version = "0.42.0"
+version = "0.42.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6d1c9c640571eba8fa5a705ccebe5c5e50aa27d4d51f4ec1614ffd1841b8a13a"
+checksum = "f1a9ac43060af7605899754daa3de2e26302c2ab4d9249a8bc16157bc53dad65"
 dependencies = [
  "aquamarine",
  "base64",
@@ -3398,9 +3410,9 @@ dependencies = [
 
 [[package]]
 name = "stack-profile"
-version = "0.42.0"
+version = "0.42.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "192a90bfa46efe194c2b8beae5523f6214714574c7e8a210c78021259f100e79"
+checksum = "90ce7ca95d8e688a35e86e0682293a2085d9b1f26e7ca5b489009c6ee0c6967a"
 dependencies = [
  "dirs",
  "gethostname",
@@ -4972,9 +4984,9 @@ dependencies = [
 
 [[package]]
 name = "zerokms-protocol"
-version = "0.12.26"
+version = "0.12.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "16f731f2de99e66396928faef44b02b39288dc9a93f77a4a3e1dcdc33c1adad0"
+checksum = "29486723fdd2bdb0c234174dc242051a46ac0c82935ccaa39e9781dbf7bcc6d2"
 dependencies = [
  "base64",
  "cipherstash-config",
diff --git a/packages/protect-ffi/crates/protect-ffi/Cargo.toml b/packages/protect-ffi/crates/protect-ffi/Cargo.toml
index dc66143b6..681a0dd8a 100644
--- a/packages/protect-ffi/crates/protect-ffi/Cargo.toml
+++ b/packages/protect-ffi/crates/protect-ffi/Cargo.toml
@@ -20,10 +20,10 @@ crate-type = ["cdylib", "rlib"]
 [dependencies]
 base85 = "2.0.0"
 chrono = { version = "0.4.42", default-features = false, features = ["serde"] }
-cipherstash-client = { version = "=0.42.0", features = ["tokio"] }
-cts-common = { version = "=0.42.0", default-features = false }
+cipherstash-client = { version = "=0.42.2", features = ["tokio"] }
+cts-common = { version = "=0.42.2", default-features = false }
 eql-bindings = { version = "=3.0.2" }
-stack-auth = { version = "=0.42.0" }
+stack-auth = { version = "=0.42.2" }
 hex = "0.4.3"
 # Carries the error code across the FFI boundary (#146). `derive` is the only
 # feature wanted: `fancy` pulls in the terminal-size / colour-support crates the
@@ -42,7 +42,7 @@ zeroize = { version = "1.8", features = ["derive"] }
 
 [target.'cfg(not(target_arch = "wasm32"))'.dependencies]
 neon = { version = "1", features = ["serde", "tokio"] }
-stack-profile = { version = "=0.42.0" }
+stack-profile = { version = "=0.42.2" }
 tokio = { version = "1", features = ["full"] }
 
 [target.'cfg(target_arch = "wasm32")'.dependencies]