new file mode 100644
@@ -0,0 +1,122 @@
+From 5fde08a6cf906aa7698de2d6391d88b73006b17b Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Jos=C3=A9=20Padilla?= <jpadilla@users.noreply.github.com>
+Date: Tue, 22 Sep 2026 11:44:19 -0400
+Subject: [PATCH] fix: normalize recursive JWT payload errors
+
+CVE: CVE-2026-101918
+Upstream-Status: Backport [https://github.com/jpadilla/pyjwt/commit/5fde08a6cf906aa7698de2d6391d88b73006b17b]
+
+Backport Changes:
+- Adapted the PyJWKClient regression-test imports to the older Wrynose
+ test module, which lacks later unrelated PyJWKSet imports.
+
+(cherry picked from commit 5fde08a6cf906aa7698de2d6391d88b73006b17b)
+Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
+---
+ jwt/api_jwt.py | 2 +-
+ tests/test_api_jwt.py | 18 +++++++++++++++++-
+ tests/test_jwks_client.py | 26 +++++++++++++++++++++++++-
+ 3 files changed, 43 insertions(+), 3 deletions(-)
+
+diff --git a/jwt/api_jwt.py b/jwt/api_jwt.py
+index f298ea9..d6917c0 100644
+--- a/jwt/api_jwt.py
++++ b/jwt/api_jwt.py
+@@ -293,7 +293,7 @@ class PyJWT:
+ """
+ try:
+ payload: dict[str, Any] = json.loads(decoded["payload"])
+- except ValueError as e:
++ except (ValueError, RecursionError) as e:
+ raise DecodeError(f"Invalid payload string: {e}") from e
+ if not isinstance(payload, dict):
+ raise DecodeError("Invalid payload string: must be a json object")
+diff --git a/tests/test_api_jwt.py b/tests/test_api_jwt.py
+index dd28816..96f9179 100644
+--- a/tests/test_api_jwt.py
++++ b/tests/test_api_jwt.py
+@@ -7,6 +7,7 @@ from decimal import Decimal
+
+ import pytest
+
++import jwt as pyjwt
+ from jwt.types import Options
+ from jwt.api_jwk import PyJWK
+ from jwt.api_jwt import PyJWT
+@@ -21,7 +22,7 @@ from jwt.exceptions import (
+ InvalidSubjectError,
+ MissingRequiredClaimError,
+ )
+-from jwt.utils import base64url_decode
++from jwt.utils import base64url_decode, base64url_encode
+ from jwt.warnings import RemovedInPyjwt3Warning
+
+ from .utils import crypto_required, key_path, utc_timestamp
+@@ -177,6 +178,21 @@ class TestJWT:
+
+ assert "Invalid payload string" in str(exc.value)
+
++ def test_decode_deeply_nested_payload_throws_decode_error(self) -> None:
++ nested_payload = b"[" * 100_000 + b"]" * 100_000
++ token = ".".join(
++ (
++ "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9",
++ base64url_encode(nested_payload).decode(),
++ "",
++ )
++ )
++
++ with pytest.raises(DecodeError, match="Invalid payload") as exc:
++ pyjwt.decode(token, options={"verify_signature": False})
++
++ assert isinstance(exc.value.__cause__, RecursionError)
++
+ def test_decode_with_non_mapping_payload_throws_exception(self, jwt: PyJWT) -> None:
+ secret = "secret"
+ example_jwt = (
+diff --git a/tests/test_jwks_client.py b/tests/test_jwks_client.py
+index c66dfd7..cf6f6e1 100644
+--- a/tests/test_jwks_client.py
++++ b/tests/test_jwks_client.py
+@@ -16,7 +16,12 @@ import jwt
+ from jwt import PyJWKClient
+ from jwt.jwks_client import _NoRedirectHandler
+ from jwt.api_jwk import PyJWK
+-from jwt.exceptions import PyJWKClientConnectionError, PyJWKClientError
++from jwt.exceptions import (
++ DecodeError,
++ PyJWKClientConnectionError,
++ PyJWKClientError,
++)
++from jwt.utils import base64url_encode
+
+ from .utils import crypto_required
+
+@@ -298,6 +303,25 @@ class TestPyJWKClient:
+ "gty": "client-credentials",
+ }
+
++ def test_get_signing_key_from_jwt_rejects_deeply_nested_payload(self) -> None:
++ nested_payload = b"[" * 100_000 + b"]" * 100_000
++ header = b'{"alg":"RS256","kid":"test-key"}'
++ token = ".".join(
++ (
++ base64url_encode(header).decode(),
++ base64url_encode(nested_payload).decode(),
++ "",
++ )
++ )
++
++ with mocked_success_response(RESPONSE_DATA_WITH_MATCHING_KID) as open_mock:
++ jwks_client = PyJWKClient("https://example.test/.well-known/jwks.json")
++ with pytest.raises(DecodeError, match="Invalid payload") as exc:
++ jwks_client.get_signing_key_from_jwt(token)
++
++ assert isinstance(exc.value.__cause__, RecursionError)
++ assert open_mock.call_count == 0
++
+ def test_get_jwk_set_caches_result(self) -> None:
+ url = "https://dev-87evx9ru.auth0.com/.well-known/jwks.json"
+
+--
+2.35.6
@@ -18,6 +18,7 @@ SRC_URI += "file://CVE-2026-48522.patch \
file://CVE-2026-102271.patch \
file://CVE-2026-101917.patch \
file://CVE-2026-102275.patch \
+ file://CVE-2026-101918.patch \
"
SRC_URI[sha256sum] = "c74a7a2adf861c04d002db713dd85f84beb242228e671280bf709d765b03672b"