JWT verification uses .verify() not just .decode()

jwt.decode() in jsonwebtoken does not verify the signature — it base64-decodes the payload without checking the HMAC or RSA signature at all. An attacker can construct a JWT with any payload they want, including { role: 'admin', userId: '1' }, and your application will accept it as a valid authenticated identity. CWE-347 (Improper Verification of Cryptographic Signature) and OWASP A07 (Identification & Authentication Failures) both cite this exact pattern. Authentication built on jwt.decode() provides zero security — every token is trusted unconditionally.

Replace every jwt.decode(token) that feeds into user identity with jwt.verify(token, secret). The verify call will throw if the signature is invalid or the token is expired.

// Bad: trusts payload without signature check
import jwt from 'jsonwebtoken'
const payload = jwt.decode(token)  // no signature verification!
req.user = payload

// Good: verify the signature before trusting the payload
import jwt from 'jsonwebtoken'
try {
  const payload = jwt.verify(token, process.env.JWT_SECRET!)
  req.user = payload
} catch (err) {
  return Response.json({ error: 'Invalid or expired token' }, { status: 401 })
}

.decode() is only safe when inspecting the token header (e.g., extracting the kid claim to select the right key) BEFORE a subsequent .verify() call. It must never be the final word on identity.