Fix type confusion

Author: Keats

CHANGELOG.md

@@ -1,8 +1,9 @@
 # Changelog
 
-## 10.3.0 (unreleased)
+## 10.3.0 (2026-01-27)
 
 - Export everything needed to define your own CryptoProvider
+- Fix type confusion with exp/nbf when not required
 
 ## 10.2.0 (2025-11-06)
 

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "jsonwebtoken"
-version = "10.2.0"
+version = "10.3.0"
 authors = ["Vincent Prouillet <hello@vincentprouillet.com>"]
 license = "MIT"
 readme = "README.md"

src/errors.rs

@@ -58,6 +58,8 @@ pub enum ErrorKind {
     // Validation errors
     /// When a claim required by the validation is not present
     MissingRequiredClaim(String),
+    /// When a claim has an invalid format (eg string instead of integer)
+    InvalidClaimFormat(String),
     /// When a token’s `exp` claim indicates that it has expired
     ExpiredSignature,
     /// When a token’s `iss` claim does not match the expected issuer
@@ -98,6 +100,7 @@ impl StdError for Error {
             ErrorKind::ExpiredSignature => None,
             ErrorKind::MissingAlgorithm => None,
             ErrorKind::MissingRequiredClaim(_) => None,
+            ErrorKind::InvalidClaimFormat(_) => None,
             ErrorKind::InvalidIssuer => None,
             ErrorKind::InvalidAudience => None,
             ErrorKind::InvalidSubject => None,
@@ -131,6 +134,7 @@ impl fmt::Display for Error {
             | ErrorKind::InvalidEddsaKey
             | ErrorKind::InvalidAlgorithmName => write!(f, "{:?}", self.0),
             ErrorKind::MissingRequiredClaim(c) => write!(f, "Missing required claim: {}", c),
+            ErrorKind::InvalidClaimFormat(c) => write!(f, "Invalid format for claim: {}", c),
             ErrorKind::InvalidRsaKey(msg) => write!(f, "RSA key invalid: {}", msg),
             ErrorKind::Signing(msg) => write!(f, "Signing failed: {}", msg),
             ErrorKind::Json(err) => write!(f, "JSON error: {}", err),

src/validation.rs

@@ -274,6 +274,14 @@ pub(crate) fn validate(claims: ClaimsForValidation, options: &Validation) -> Res
     if options.validate_exp || options.validate_nbf {
         let now = get_current_timestamp();
 
+        // Reject malformed exp/nbf claim when validation is enabled
+        if options.validate_exp && matches!(claims.exp, TryParse::FailedToParse) {
+            return Err(new_error(ErrorKind::InvalidClaimFormat("exp".to_string())));
+        }
+        if options.validate_nbf && matches!(claims.nbf, TryParse::FailedToParse) {
+            return Err(new_error(ErrorKind::InvalidClaimFormat("nbf".to_string())));
+        }
+
         if matches!(claims.exp, TryParse::Parsed(exp) if exp < options.reject_tokens_expiring_in_less_than)
         {
             return Err(new_error(ErrorKind::InvalidToken));

tests/hmac.rs

@@ -290,3 +290,59 @@ fn verify_hs256_rfc7517_appendix_a1() {
     let c = decode::<C>(token, &key, &validation).unwrap();
     assert_eq!(c.claims.iss, "joe");
 }
+
+// Regression tests for type confusion vulnerability where malformed claims
+// (eg nbf or exp as strings) were silently treated as "not present" when not required
+#[derive(Debug, Serialize)]
+struct ClaimsWithStringNbf {
+    sub: String,
+    nbf: String, // should be a number
+}
+
+#[derive(Debug, Serialize)]
+struct ClaimsWithStringExp {
+    sub: String,
+    exp: String, // should be a number
+}
+
+#[test]
+#[wasm_bindgen_test]
+fn test_string_nbf_rejected_when_validate_nbf_enabled() {
+    // Create token with nbf as string (malformed)
+    let claims = ClaimsWithStringNbf {
+        sub: "test".to_string(),
+        nbf: "99999999999".to_string(), // Far future as string
+    };
+    let token = encode(&Header::default(), &claims, &EncodingKey::from_secret(b"secret")).unwrap();
+
+    let mut validation = Validation::new(Algorithm::HS256);
+    validation.validate_nbf = true;
+    validation.required_spec_claims = std::collections::HashSet::new();
+
+    let result =
+        decode::<serde_json::Value>(&token, &DecodingKey::from_secret(b"secret"), &validation);
+
+    assert!(result.is_err());
+    assert_eq!(result.unwrap_err().into_kind(), ErrorKind::InvalidClaimFormat("nbf".to_string()));
+}
+
+#[test]
+#[wasm_bindgen_test]
+fn test_string_exp_rejected_when_validate_exp_enabled() {
+    // Create token with exp as string (malformed)
+    let claims = ClaimsWithStringExp {
+        sub: "test".to_string(),
+        exp: "99999999999".to_string(), // Far future as string
+    };
+    let token = encode(&Header::default(), &claims, &EncodingKey::from_secret(b"secret")).unwrap();
+
+    let mut validation = Validation::new(Algorithm::HS256);
+    validation.validate_exp = true;
+    validation.required_spec_claims = std::collections::HashSet::new();
+
+    let result =
+        decode::<serde_json::Value>(&token, &DecodingKey::from_secret(b"secret"), &validation);
+
+    assert!(result.is_err());
+    assert_eq!(result.unwrap_err().into_kind(), ErrorKind::InvalidClaimFormat("exp".to_string()));
+}