In verify.js, I think there is an issue with the payload decoding. Or at least with robustness.
I receive some errors (TypeError: Cannot read property 'nbf' of null) with the following lines (Around line 110 of verify.js):

  var payload;

  try {
    payload = decode(jwtString);
  } catch(err) {
    return done(err);
  }

  if (typeof payload.nbf !== 'undefined' && !options.ignoreNotBefore) {
//...

The function decode sometimes (if the jwtString is malformed ?) returns null, isn't a good idea to check the payload before trying to use the nbf ?
It's a simple if in the try-catch, I can do a PR if needed.

Regards,

Gp2mv3