The vulnerability is usually in verifiers rather than signers.

See, for example:

https://github.com/firebase/php-jwt/issues/351