Despite the verify action is in fact synchronize, the callback API does not. It is specifically this line that [released Zalgo](https://medium.com/@bluepnume/intentionally-unleashing-zalgo-with-promises-ab3f63ead2fd). https://github.com/auth0/node-jsonwebtoken/blob/5a7fa23c0b4ac6c25304dab8767ef840b43a0eca/verify.js#L24 Which can be fixed by wrapping it as such ```js done = function(err, data) { setImmediate(callback, err, data); }; ```
Despite the verify action is in fact synchronize, the callback API does not.
It is specifically this line that released Zalgo.
node-jsonwebtoken/verify.js
Line 24 in 5a7fa23
Which can be fixed by wrapping it as such