diff --git a/impl/src/main/java/io/jsonwebtoken/impl/DefaultJwtParser.java b/impl/src/main/java/io/jsonwebtoken/impl/DefaultJwtParser.java
index 538c56ef5..75faa419a 100644
--- a/impl/src/main/java/io/jsonwebtoken/impl/DefaultJwtParser.java
+++ b/impl/src/main/java/io/jsonwebtoken/impl/DefaultJwtParser.java
@@ -637,7 +637,7 @@ private byte[] verifySignature(final TokenizedJwt tokenized, final JwsHeader jws
                     // consumable, but not claims, so convert to byte array:
                     payloadBytes = Streams.bytes(in, "Unable to convert payload to byte array.");
                 }
-            } finally {
+            } finally { // always ensure closed per https://github.com/jwtk/jjwt/issues/949
                 Objects.nullSafeClose(in);
             }
         }