jose 5.3.0 → 5.4.1

package/dist/browser/jwks/remote.js

@@ -9,7 +9,7 @@ function isCloudflareWorkers() {
 let USER_AGENT;
 if (typeof navigator === 'undefined' || !navigator.userAgent?.startsWith?.('Mozilla/5.0 ')) {
     const NAME = 'jose';
-    const VERSION = 'v5.3.0';
+    const VERSION = 'v5.4.1';
     USER_AGENT = `${NAME}/${VERSION}`;
 }
 class RemoteJWKSet {

package/dist/browser/jwt/decrypt.js

@@ -6,14 +6,14 @@ export async function jwtDecrypt(jwt, key, options) {
     const payload = jwtPayload(decrypted.protectedHeader, decrypted.plaintext, options);
     const { protectedHeader } = decrypted;
     if (protectedHeader.iss !== undefined && protectedHeader.iss !== payload.iss) {
-        throw new JWTClaimValidationFailed('replicated "iss" claim header parameter mismatch', 'iss', 'mismatch');
+        throw new JWTClaimValidationFailed('replicated "iss" claim header parameter mismatch', payload, 'iss', 'mismatch');
     }
     if (protectedHeader.sub !== undefined && protectedHeader.sub !== payload.sub) {
-        throw new JWTClaimValidationFailed('replicated "sub" claim header parameter mismatch', 'sub', 'mismatch');
+        throw new JWTClaimValidationFailed('replicated "sub" claim header parameter mismatch', payload, 'sub', 'mismatch');
     }
     if (protectedHeader.aud !== undefined &&
         JSON.stringify(protectedHeader.aud) !== JSON.stringify(payload.aud)) {
-        throw new JWTClaimValidationFailed('replicated "aud" claim header parameter mismatch', 'aud', 'mismatch');
+        throw new JWTClaimValidationFailed('replicated "aud" claim header parameter mismatch', payload, 'aud', 'mismatch');
     }
     const result = { payload, protectedHeader };
     if (typeof key === 'function') {

package/dist/browser/lib/jwt_claims_set.js

@@ -14,12 +14,6 @@ const checkAudiencePresence = (audPayload, audOption) => {
     return false;
 };
 export default (protectedHeader, encodedPayload, options = {}) => {
-    const { typ } = options;
-    if (typ &&
-        (typeof protectedHeader.typ !== 'string' ||
-            normalizeTyp(protectedHeader.typ) !== normalizeTyp(typ))) {
-        throw new JWTClaimValidationFailed('unexpected "typ" JWT header value', 'typ', 'check_failed');
-    }
     let payload;
     try {
         payload = JSON.parse(decoder.decode(encodedPayload));
@@ -29,6 +23,12 @@ export default (protectedHeader, encodedPayload, options = {}) => {
     if (!isObject(payload)) {
         throw new JWTInvalid('JWT Claims Set must be a top-level JSON object');
     }
+    const { typ } = options;
+    if (typ &&
+        (typeof protectedHeader.typ !== 'string' ||
+            normalizeTyp(protectedHeader.typ) !== normalizeTyp(typ))) {
+        throw new JWTClaimValidationFailed('unexpected "typ" JWT header value', payload, 'typ', 'check_failed');
+    }
     const { requiredClaims = [], issuer, subject, audience, maxTokenAge } = options;
     const presenceCheck = [...requiredClaims];
     if (maxTokenAge !== undefined)
@@ -41,18 +41,18 @@ export default (protectedHeader, encodedPayload, options = {}) => {
         presenceCheck.push('iss');
     for (const claim of new Set(presenceCheck.reverse())) {
         if (!(claim in payload)) {
-            throw new JWTClaimValidationFailed(`missing required "${claim}" claim`, claim, 'missing');
+            throw new JWTClaimValidationFailed(`missing required "${claim}" claim`, payload, claim, 'missing');
         }
     }
     if (issuer && !(Array.isArray(issuer) ? issuer : [issuer]).includes(payload.iss)) {
-        throw new JWTClaimValidationFailed('unexpected "iss" claim value', 'iss', 'check_failed');
+        throw new JWTClaimValidationFailed('unexpected "iss" claim value', payload, 'iss', 'check_failed');
     }
     if (subject && payload.sub !== subject) {
-        throw new JWTClaimValidationFailed('unexpected "sub" claim value', 'sub', 'check_failed');
+        throw new JWTClaimValidationFailed('unexpected "sub" claim value', payload, 'sub', 'check_failed');
     }
     if (audience &&
         !checkAudiencePresence(payload.aud, typeof audience === 'string' ? [audience] : audience)) {
-        throw new JWTClaimValidationFailed('unexpected "aud" claim value', 'aud', 'check_failed');
+        throw new JWTClaimValidationFailed('unexpected "aud" claim value', payload, 'aud', 'check_failed');
     }
     let tolerance;
     switch (typeof options.clockTolerance) {
@@ -71,32 +71,32 @@ export default (protectedHeader, encodedPayload, options = {}) => {
     const { currentDate } = options;
     const now = epoch(currentDate || new Date());
     if ((payload.iat !== undefined || maxTokenAge) && typeof payload.iat !== 'number') {
-        throw new JWTClaimValidationFailed('"iat" claim must be a number', 'iat', 'invalid');
+        throw new JWTClaimValidationFailed('"iat" claim must be a number', payload, 'iat', 'invalid');
     }
     if (payload.nbf !== undefined) {
         if (typeof payload.nbf !== 'number') {
-            throw new JWTClaimValidationFailed('"nbf" claim must be a number', 'nbf', 'invalid');
+            throw new JWTClaimValidationFailed('"nbf" claim must be a number', payload, 'nbf', 'invalid');
         }
         if (payload.nbf > now + tolerance) {
-            throw new JWTClaimValidationFailed('"nbf" claim timestamp check failed', 'nbf', 'check_failed');
+            throw new JWTClaimValidationFailed('"nbf" claim timestamp check failed', payload, 'nbf', 'check_failed');
         }
     }
     if (payload.exp !== undefined) {
         if (typeof payload.exp !== 'number') {
-            throw new JWTClaimValidationFailed('"exp" claim must be a number', 'exp', 'invalid');
+            throw new JWTClaimValidationFailed('"exp" claim must be a number', payload, 'exp', 'invalid');
         }
         if (payload.exp <= now - tolerance) {
-            throw new JWTExpired('"exp" claim timestamp check failed', 'exp', 'check_failed');
+            throw new JWTExpired('"exp" claim timestamp check failed', payload, 'exp', 'check_failed');
         }
     }
     if (maxTokenAge) {
         const age = now - payload.iat;
         const max = typeof maxTokenAge === 'number' ? maxTokenAge : secs(maxTokenAge);
         if (age - tolerance > max) {
-            throw new JWTExpired('"iat" claim timestamp check failed (too far in the past)', 'iat', 'check_failed');
+            throw new JWTExpired('"iat" claim timestamp check failed (too far in the past)', payload, 'iat', 'check_failed');
         }
         if (age < 0 - tolerance) {
-            throw new JWTClaimValidationFailed('"iat" claim timestamp check failed (it should be in the past)', 'iat', 'check_failed');
+            throw new JWTClaimValidationFailed('"iat" claim timestamp check failed (it should be in the past)', payload, 'iat', 'check_failed');
         }
     }
     return payload;

package/dist/browser/util/errors.js

@@ -13,22 +13,24 @@ export class JWTClaimValidationFailed extends JOSEError {
     static get code() {
         return 'ERR_JWT_CLAIM_VALIDATION_FAILED';
     }
-    constructor(message, claim = 'unspecified', reason = 'unspecified') {
+    constructor(message, payload, claim = 'unspecified', reason = 'unspecified') {
         super(message);
         this.code = 'ERR_JWT_CLAIM_VALIDATION_FAILED';
         this.claim = claim;
         this.reason = reason;
+        this.payload = payload;
     }
 }
 export class JWTExpired extends JOSEError {
     static get code() {
         return 'ERR_JWT_EXPIRED';
     }
-    constructor(message, claim = 'unspecified', reason = 'unspecified') {
+    constructor(message, payload, claim = 'unspecified', reason = 'unspecified') {
         super(message);
         this.code = 'ERR_JWT_EXPIRED';
         this.claim = claim;
         this.reason = reason;
+        this.payload = payload;
     }
 }
 export class JOSEAlgNotAllowed extends JOSEError {

package/dist/node/cjs/jwks/remote.js

@@ -12,7 +12,7 @@ function isCloudflareWorkers() {
 let USER_AGENT;
 if (typeof navigator === 'undefined' || !navigator.userAgent?.startsWith?.('Mozilla/5.0 ')) {
     const NAME = 'jose';
-    const VERSION = 'v5.3.0';
+    const VERSION = 'v5.4.1';
     USER_AGENT = `${NAME}/${VERSION}`;
 }
 class RemoteJWKSet {

package/dist/node/cjs/jwt/decrypt.js

@@ -9,14 +9,14 @@ async function jwtDecrypt(jwt, key, options) {
     const payload = (0, jwt_claims_set_js_1.default)(decrypted.protectedHeader, decrypted.plaintext, options);
     const { protectedHeader } = decrypted;
     if (protectedHeader.iss !== undefined && protectedHeader.iss !== payload.iss) {
-        throw new errors_js_1.JWTClaimValidationFailed('replicated "iss" claim header parameter mismatch', 'iss', 'mismatch');
+        throw new errors_js_1.JWTClaimValidationFailed('replicated "iss" claim header parameter mismatch', payload, 'iss', 'mismatch');
     }
     if (protectedHeader.sub !== undefined && protectedHeader.sub !== payload.sub) {
-        throw new errors_js_1.JWTClaimValidationFailed('replicated "sub" claim header parameter mismatch', 'sub', 'mismatch');
+        throw new errors_js_1.JWTClaimValidationFailed('replicated "sub" claim header parameter mismatch', payload, 'sub', 'mismatch');
     }
     if (protectedHeader.aud !== undefined &&
         JSON.stringify(protectedHeader.aud) !== JSON.stringify(payload.aud)) {
-        throw new errors_js_1.JWTClaimValidationFailed('replicated "aud" claim header parameter mismatch', 'aud', 'mismatch');
+        throw new errors_js_1.JWTClaimValidationFailed('replicated "aud" claim header parameter mismatch', payload, 'aud', 'mismatch');
     }
     const result = { payload, protectedHeader };
     if (typeof key === 'function') {

package/dist/node/cjs/lib/jwt_claims_set.js

@@ -16,12 +16,6 @@ const checkAudiencePresence = (audPayload, audOption) => {
     return false;
 };
 exports.default = (protectedHeader, encodedPayload, options = {}) => {
-    const { typ } = options;
-    if (typ &&
-        (typeof protectedHeader.typ !== 'string' ||
-            normalizeTyp(protectedHeader.typ) !== normalizeTyp(typ))) {
-        throw new errors_js_1.JWTClaimValidationFailed('unexpected "typ" JWT header value', 'typ', 'check_failed');
-    }
     let payload;
     try {
         payload = JSON.parse(buffer_utils_js_1.decoder.decode(encodedPayload));
@@ -31,6 +25,12 @@ exports.default = (protectedHeader, encodedPayload, options = {}) => {
     if (!(0, is_object_js_1.default)(payload)) {
         throw new errors_js_1.JWTInvalid('JWT Claims Set must be a top-level JSON object');
     }
+    const { typ } = options;
+    if (typ &&
+        (typeof protectedHeader.typ !== 'string' ||
+            normalizeTyp(protectedHeader.typ) !== normalizeTyp(typ))) {
+        throw new errors_js_1.JWTClaimValidationFailed('unexpected "typ" JWT header value', payload, 'typ', 'check_failed');
+    }
     const { requiredClaims = [], issuer, subject, audience, maxTokenAge } = options;
     const presenceCheck = [...requiredClaims];
     if (maxTokenAge !== undefined)
@@ -43,18 +43,18 @@ exports.default = (protectedHeader, encodedPayload, options = {}) => {
         presenceCheck.push('iss');
     for (const claim of new Set(presenceCheck.reverse())) {
         if (!(claim in payload)) {
-            throw new errors_js_1.JWTClaimValidationFailed(`missing required "${claim}" claim`, claim, 'missing');
+            throw new errors_js_1.JWTClaimValidationFailed(`missing required "${claim}" claim`, payload, claim, 'missing');
         }
     }
     if (issuer && !(Array.isArray(issuer) ? issuer : [issuer]).includes(payload.iss)) {
-        throw new errors_js_1.JWTClaimValidationFailed('unexpected "iss" claim value', 'iss', 'check_failed');
+        throw new errors_js_1.JWTClaimValidationFailed('unexpected "iss" claim value', payload, 'iss', 'check_failed');
     }
     if (subject && payload.sub !== subject) {
-        throw new errors_js_1.JWTClaimValidationFailed('unexpected "sub" claim value', 'sub', 'check_failed');
+        throw new errors_js_1.JWTClaimValidationFailed('unexpected "sub" claim value', payload, 'sub', 'check_failed');
     }
     if (audience &&
         !checkAudiencePresence(payload.aud, typeof audience === 'string' ? [audience] : audience)) {
-        throw new errors_js_1.JWTClaimValidationFailed('unexpected "aud" claim value', 'aud', 'check_failed');
+        throw new errors_js_1.JWTClaimValidationFailed('unexpected "aud" claim value', payload, 'aud', 'check_failed');
     }
     let tolerance;
     switch (typeof options.clockTolerance) {
@@ -73,32 +73,32 @@ exports.default = (protectedHeader, encodedPayload, options = {}) => {
     const { currentDate } = options;
     const now = (0, epoch_js_1.default)(currentDate || new Date());
     if ((payload.iat !== undefined || maxTokenAge) && typeof payload.iat !== 'number') {
-        throw new errors_js_1.JWTClaimValidationFailed('"iat" claim must be a number', 'iat', 'invalid');
+        throw new errors_js_1.JWTClaimValidationFailed('"iat" claim must be a number', payload, 'iat', 'invalid');
     }
     if (payload.nbf !== undefined) {
         if (typeof payload.nbf !== 'number') {
-            throw new errors_js_1.JWTClaimValidationFailed('"nbf" claim must be a number', 'nbf', 'invalid');
+            throw new errors_js_1.JWTClaimValidationFailed('"nbf" claim must be a number', payload, 'nbf', 'invalid');
         }
         if (payload.nbf > now + tolerance) {
-            throw new errors_js_1.JWTClaimValidationFailed('"nbf" claim timestamp check failed', 'nbf', 'check_failed');
+            throw new errors_js_1.JWTClaimValidationFailed('"nbf" claim timestamp check failed', payload, 'nbf', 'check_failed');
         }
     }
     if (payload.exp !== undefined) {
         if (typeof payload.exp !== 'number') {
-            throw new errors_js_1.JWTClaimValidationFailed('"exp" claim must be a number', 'exp', 'invalid');
+            throw new errors_js_1.JWTClaimValidationFailed('"exp" claim must be a number', payload, 'exp', 'invalid');
         }
         if (payload.exp <= now - tolerance) {
-            throw new errors_js_1.JWTExpired('"exp" claim timestamp check failed', 'exp', 'check_failed');
+            throw new errors_js_1.JWTExpired('"exp" claim timestamp check failed', payload, 'exp', 'check_failed');
         }
     }
     if (maxTokenAge) {
         const age = now - payload.iat;
         const max = typeof maxTokenAge === 'number' ? maxTokenAge : (0, secs_js_1.default)(maxTokenAge);
         if (age - tolerance > max) {
-            throw new errors_js_1.JWTExpired('"iat" claim timestamp check failed (too far in the past)', 'iat', 'check_failed');
+            throw new errors_js_1.JWTExpired('"iat" claim timestamp check failed (too far in the past)', payload, 'iat', 'check_failed');
         }
         if (age < 0 - tolerance) {
-            throw new errors_js_1.JWTClaimValidationFailed('"iat" claim timestamp check failed (it should be in the past)', 'iat', 'check_failed');
+            throw new errors_js_1.JWTClaimValidationFailed('"iat" claim timestamp check failed (it should be in the past)', payload, 'iat', 'check_failed');
         }
     }
     return payload;

package/dist/node/cjs/util/errors.js

@@ -20,10 +20,12 @@ class JWTClaimValidationFailed extends JOSEError {
     code = 'ERR_JWT_CLAIM_VALIDATION_FAILED';
     claim;
     reason;
-    constructor(message, claim = 'unspecified', reason = 'unspecified') {
+    payload;
+    constructor(message, payload, claim = 'unspecified', reason = 'unspecified') {
         super(message);
         this.claim = claim;
         this.reason = reason;
+        this.payload = payload;
     }
 }
 exports.JWTClaimValidationFailed = JWTClaimValidationFailed;
@@ -34,10 +36,12 @@ class JWTExpired extends JOSEError {
     code = 'ERR_JWT_EXPIRED';
     claim;
     reason;
-    constructor(message, claim = 'unspecified', reason = 'unspecified') {
+    payload;
+    constructor(message, payload, claim = 'unspecified', reason = 'unspecified') {
         super(message);
         this.claim = claim;
         this.reason = reason;
+        this.payload = payload;
     }
 }
 exports.JWTExpired = JWTExpired;

package/dist/node/esm/jwks/remote.js

@@ -9,7 +9,7 @@ function isCloudflareWorkers() {
 let USER_AGENT;
 if (typeof navigator === 'undefined' || !navigator.userAgent?.startsWith?.('Mozilla/5.0 ')) {
     const NAME = 'jose';
-    const VERSION = 'v5.3.0';
+    const VERSION = 'v5.4.1';
     USER_AGENT = `${NAME}/${VERSION}`;
 }
 class RemoteJWKSet {

package/dist/node/esm/jwt/decrypt.js

@@ -6,14 +6,14 @@ export async function jwtDecrypt(jwt, key, options) {
     const payload = jwtPayload(decrypted.protectedHeader, decrypted.plaintext, options);
     const { protectedHeader } = decrypted;
     if (protectedHeader.iss !== undefined && protectedHeader.iss !== payload.iss) {
-        throw new JWTClaimValidationFailed('replicated "iss" claim header parameter mismatch', 'iss', 'mismatch');
+        throw new JWTClaimValidationFailed('replicated "iss" claim header parameter mismatch', payload, 'iss', 'mismatch');
     }
     if (protectedHeader.sub !== undefined && protectedHeader.sub !== payload.sub) {
-        throw new JWTClaimValidationFailed('replicated "sub" claim header parameter mismatch', 'sub', 'mismatch');
+        throw new JWTClaimValidationFailed('replicated "sub" claim header parameter mismatch', payload, 'sub', 'mismatch');
     }
     if (protectedHeader.aud !== undefined &&
         JSON.stringify(protectedHeader.aud) !== JSON.stringify(payload.aud)) {
-        throw new JWTClaimValidationFailed('replicated "aud" claim header parameter mismatch', 'aud', 'mismatch');
+        throw new JWTClaimValidationFailed('replicated "aud" claim header parameter mismatch', payload, 'aud', 'mismatch');
     }
     const result = { payload, protectedHeader };
     if (typeof key === 'function') {

package/dist/node/esm/lib/jwt_claims_set.js

@@ -14,12 +14,6 @@ const checkAudiencePresence = (audPayload, audOption) => {
     return false;
 };
 export default (protectedHeader, encodedPayload, options = {}) => {
-    const { typ } = options;
-    if (typ &&
-        (typeof protectedHeader.typ !== 'string' ||
-            normalizeTyp(protectedHeader.typ) !== normalizeTyp(typ))) {
-        throw new JWTClaimValidationFailed('unexpected "typ" JWT header value', 'typ', 'check_failed');
-    }
     let payload;
     try {
         payload = JSON.parse(decoder.decode(encodedPayload));
@@ -29,6 +23,12 @@ export default (protectedHeader, encodedPayload, options = {}) => {
     if (!isObject(payload)) {
         throw new JWTInvalid('JWT Claims Set must be a top-level JSON object');
     }
+    const { typ } = options;
+    if (typ &&
+        (typeof protectedHeader.typ !== 'string' ||
+            normalizeTyp(protectedHeader.typ) !== normalizeTyp(typ))) {
+        throw new JWTClaimValidationFailed('unexpected "typ" JWT header value', payload, 'typ', 'check_failed');
+    }
     const { requiredClaims = [], issuer, subject, audience, maxTokenAge } = options;
     const presenceCheck = [...requiredClaims];
     if (maxTokenAge !== undefined)
@@ -41,18 +41,18 @@ export default (protectedHeader, encodedPayload, options = {}) => {
         presenceCheck.push('iss');
     for (const claim of new Set(presenceCheck.reverse())) {
         if (!(claim in payload)) {
-            throw new JWTClaimValidationFailed(`missing required "${claim}" claim`, claim, 'missing');
+            throw new JWTClaimValidationFailed(`missing required "${claim}" claim`, payload, claim, 'missing');
         }
     }
     if (issuer && !(Array.isArray(issuer) ? issuer : [issuer]).includes(payload.iss)) {
-        throw new JWTClaimValidationFailed('unexpected "iss" claim value', 'iss', 'check_failed');
+        throw new JWTClaimValidationFailed('unexpected "iss" claim value', payload, 'iss', 'check_failed');
     }
     if (subject && payload.sub !== subject) {
-        throw new JWTClaimValidationFailed('unexpected "sub" claim value', 'sub', 'check_failed');
+        throw new JWTClaimValidationFailed('unexpected "sub" claim value', payload, 'sub', 'check_failed');
     }
     if (audience &&
         !checkAudiencePresence(payload.aud, typeof audience === 'string' ? [audience] : audience)) {
-        throw new JWTClaimValidationFailed('unexpected "aud" claim value', 'aud', 'check_failed');
+        throw new JWTClaimValidationFailed('unexpected "aud" claim value', payload, 'aud', 'check_failed');
     }
     let tolerance;
     switch (typeof options.clockTolerance) {
@@ -71,32 +71,32 @@ export default (protectedHeader, encodedPayload, options = {}) => {
     const { currentDate } = options;
     const now = epoch(currentDate || new Date());
     if ((payload.iat !== undefined || maxTokenAge) && typeof payload.iat !== 'number') {
-        throw new JWTClaimValidationFailed('"iat" claim must be a number', 'iat', 'invalid');
+        throw new JWTClaimValidationFailed('"iat" claim must be a number', payload, 'iat', 'invalid');
     }
     if (payload.nbf !== undefined) {
         if (typeof payload.nbf !== 'number') {
-            throw new JWTClaimValidationFailed('"nbf" claim must be a number', 'nbf', 'invalid');
+            throw new JWTClaimValidationFailed('"nbf" claim must be a number', payload, 'nbf', 'invalid');
         }
         if (payload.nbf > now + tolerance) {
-            throw new JWTClaimValidationFailed('"nbf" claim timestamp check failed', 'nbf', 'check_failed');
+            throw new JWTClaimValidationFailed('"nbf" claim timestamp check failed', payload, 'nbf', 'check_failed');
         }
     }
     if (payload.exp !== undefined) {
         if (typeof payload.exp !== 'number') {
-            throw new JWTClaimValidationFailed('"exp" claim must be a number', 'exp', 'invalid');
+            throw new JWTClaimValidationFailed('"exp" claim must be a number', payload, 'exp', 'invalid');
         }
         if (payload.exp <= now - tolerance) {
-            throw new JWTExpired('"exp" claim timestamp check failed', 'exp', 'check_failed');
+            throw new JWTExpired('"exp" claim timestamp check failed', payload, 'exp', 'check_failed');
         }
     }
     if (maxTokenAge) {
         const age = now - payload.iat;
         const max = typeof maxTokenAge === 'number' ? maxTokenAge : secs(maxTokenAge);
         if (age - tolerance > max) {
-            throw new JWTExpired('"iat" claim timestamp check failed (too far in the past)', 'iat', 'check_failed');
+            throw new JWTExpired('"iat" claim timestamp check failed (too far in the past)', payload, 'iat', 'check_failed');
         }
         if (age < 0 - tolerance) {
-            throw new JWTClaimValidationFailed('"iat" claim timestamp check failed (it should be in the past)', 'iat', 'check_failed');
+            throw new JWTClaimValidationFailed('"iat" claim timestamp check failed (it should be in the past)', payload, 'iat', 'check_failed');
         }
     }
     return payload;

package/dist/node/esm/util/errors.js

@@ -16,10 +16,12 @@ export class JWTClaimValidationFailed extends JOSEError {
     code = 'ERR_JWT_CLAIM_VALIDATION_FAILED';
     claim;
     reason;
-    constructor(message, claim = 'unspecified', reason = 'unspecified') {
+    payload;
+    constructor(message, payload, claim = 'unspecified', reason = 'unspecified') {
         super(message);
         this.claim = claim;
         this.reason = reason;
+        this.payload = payload;
     }
 }
 export class JWTExpired extends JOSEError {
@@ -29,10 +31,12 @@ export class JWTExpired extends JOSEError {
     code = 'ERR_JWT_EXPIRED';
     claim;
     reason;
-    constructor(message, claim = 'unspecified', reason = 'unspecified') {
+    payload;
+    constructor(message, payload, claim = 'unspecified', reason = 'unspecified') {
         super(message);
         this.claim = claim;
         this.reason = reason;
+        this.payload = payload;
     }
 }
 export class JOSEAlgNotAllowed extends JOSEError {

package/dist/types/util/errors.d.ts

@@ -1,4 +1,4 @@
-import type { KeyLike } from '../types';
+import type { JWTPayload, KeyLike } from '../types';
 /**
  * A generic Error that all other JOSE specific Error subclasses extend.
  *
@@ -27,8 +27,15 @@ export declare class JWTClaimValidationFailed extends JOSEError {
     claim: string;
     /** Reason code for the validation failure. */
     reason: string;
+    /**
+     * The parsed JWT Claims Set (aka payload). Other JWT claims may or may not have been verified at
+     * this point. The JSON Web Signature (JWS) or a JSON Web Encryption (JWE) structures' integrity
+     * has however been verified. Claims Set verification happens after the JWS Signature or JWE
+     * Decryption processes.
+     */
+    payload: JWTPayload;
     /** @ignore */
-    constructor(message: string, claim?: string, reason?: string);
+    constructor(message: string, payload: JWTPayload, claim?: string, reason?: string);
 }
 /**
  * An error subclass thrown when a JWT is expired.
@@ -42,8 +49,15 @@ export declare class JWTExpired extends JOSEError implements JWTClaimValidationF
     claim: string;
     /** Reason code for the validation failure. */
     reason: string;
+    /**
+     * The parsed JWT Claims Set (aka payload). Other JWT claims may or may not have been verified at
+     * this point. The JSON Web Signature (JWS) or a JSON Web Encryption (JWE) structures' integrity
+     * has however been verified. Claims Set verification happens after the JWS Signature or JWE
+     * Decryption processes.
+     */
+    payload: JWTPayload;
     /** @ignore */
-    constructor(message: string, claim?: string, reason?: string);
+    constructor(message: string, payload: JWTPayload, claim?: string, reason?: string);
 }
 /**
  * An error subclass thrown when a JOSE Algorithm is not allowed per developer preference.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jose",
-  "version": "5.3.0",
+  "version": "5.4.1",
   "description": "JWA, JWS, JWE, JWT, JWK, JWKS for Node.js, Browser, Cloudflare Workers, Deno, Bun, and other Web-interoperable runtimes",
   "keywords": [
     "browser",