For those of you concerned about if a JWT library you're using is vulnerable, you can see the current list of verified/validate clients for each language here: http://jwt.io/ (page down to see the list)

My team has been using ruby-jwt, so I'm glad to see that at least does not seem to be on the list of vulnerable libraries.