jsonwebtoken vulnerable to signature validation bypass due to insecure default algorithm in jwt.verify() #1151