PyJWT versions prior to 2.14.0 contain a vulnerability where deeply nested JSON arrays in the JWT header cause a RecursionError during decoding. This error is not caught by the library's usual exception handling, resulting in an unhandled exception that leads to HTTP 500 server errors and full tracebacks logged. The issue allows an unauthenticated attacker to cause a denial of service on JWT validation endpoints by sending crafted tokens with excessively nested headers. The flaw is fixed in PyJWT 2.14.0 by catching RecursionError and converting it to a DecodeError.