From f7967668a675097212cd99e585d050146962d0d1 Mon Sep 17 00:00:00 2001
From: Anshul Nautiyal <anshulnautiyal2006@gmail.com>
Date: Fri, 24 Jul 2026 14:34:18 +0530
Subject: [PATCH] fix: reject NumericDates outside Instant range

---
 .../com/auth0/jwt/impl/PayloadDeserializer.java    |  9 ++++++++-
 .../auth0/jwt/impl/PayloadDeserializerTest.java    | 14 +++++++++++++-
 2 files changed, 21 insertions(+), 2 deletions(-)

diff --git a/lib/src/main/java/com/auth0/jwt/impl/PayloadDeserializer.java b/lib/src/main/java/com/auth0/jwt/impl/PayloadDeserializer.java
index 69df87a1..89d5a433 100644
--- a/lib/src/main/java/com/auth0/jwt/impl/PayloadDeserializer.java
+++ b/lib/src/main/java/com/auth0/jwt/impl/PayloadDeserializer.java
@@ -13,6 +13,7 @@
 import com.fasterxml.jackson.databind.deser.std.StdDeserializer;
 
 import java.io.IOException;
+import java.time.DateTimeException;
 import java.time.Instant;
 import java.util.*;
 
@@ -88,7 +89,13 @@ Instant getInstantFromSeconds(Map<String, JsonNode> tree, String claimName) {
                     "The claim '%s' value (%s) is out of the range representable as a NumericDate.",
                     claimName, node.asText()));
         }
-        return Instant.ofEpochSecond(node.asLong());
+        try {
+            return Instant.ofEpochSecond(node.asLong());
+        } catch (DateTimeException e) {
+            throw new JWTDecodeException(String.format(
+                    "The claim '%s' value (%s) is out of the range representable as a NumericDate.",
+                    claimName, node.asText()), e);
+        }
     }
 
     String getString(Map<String, JsonNode> tree, String claimName) {
diff --git a/lib/src/test/java/com/auth0/jwt/impl/PayloadDeserializerTest.java b/lib/src/test/java/com/auth0/jwt/impl/PayloadDeserializerTest.java
index f734b572..92c1aba7 100644
--- a/lib/src/test/java/com/auth0/jwt/impl/PayloadDeserializerTest.java
+++ b/lib/src/test/java/com/auth0/jwt/impl/PayloadDeserializerTest.java
@@ -269,6 +269,18 @@ public void shouldThrowOutOfRangeWhenNumericDateExceedsLong() {
         deserializer.getInstantFromSeconds(tree, "key");
     }
 
+    @Test
+    public void shouldThrowOutOfRangeWhenNumericDateExceedsInstantRange() {
+        exception.expect(JWTDecodeException.class);
+        exception.expectMessage(
+                "The claim 'key' value (9223372036854775807) is out of the range representable as a NumericDate.");
+
+        Map<String, JsonNode> tree = new HashMap<>();
+        tree.put("key", new LongNode(Long.MAX_VALUE));
+
+        deserializer.getInstantFromSeconds(tree, "key");
+    }
+
     @Test
     public void shouldGetNullStringWhenParsingNullNode() {
         Map<String, JsonNode> tree = new HashMap<>();
@@ -299,4 +311,4 @@ public void shouldGetStringWhenParsingTextNode() {
         assertThat(text, is("something here"));
     }
 
-}
\ No newline at end of file
+}