diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7238cb54..cf05db0f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -11,6 +11,7 @@
 **Fixes and enhancements:**
 
 - Updated README to correctly document `OpenSSL::HMAC` documentation [#617](https://github.com/jwt/ruby-jwt/pull/617) ([@aedryan](https://github.com/aedryan))
+- Verify JWT header format [#622](https://github.com/jwt/ruby-jwt/pull/622) ([@304](https://github.com/304))
 - Your contribution here
 
 ## [v2.9.1](https://github.com/jwt/ruby-jwt/tree/v2.9.1) (2024-09-23)
diff --git a/lib/jwt/decode.rb b/lib/jwt/decode.rb
index a8de603d..2e7694dd 100644
--- a/lib/jwt/decode.rb
+++ b/lib/jwt/decode.rb
@@ -135,7 +135,7 @@ def decode_signature
     end
 
     def alg_in_header
-      header['alg']
+      header.is_a?(Hash) && header['alg']
     end
 
     def header
diff --git a/spec/jwt/jwt_spec.rb b/spec/jwt/jwt_spec.rb
index c11d233e..6b6576ac 100644
--- a/spec/jwt/jwt_spec.rb
+++ b/spec/jwt/jwt_spec.rb
@@ -7,6 +7,7 @@
     data = {
       :empty_token => 'e30K.e30K.e30K',
       :empty_token_2_segment => 'e30K.e30K.',
+      :invalid_header_token => 'W10.e30K.e30K',
       :secret => 'My$ecretK3y',
       :rsa_private => test_pkey('rsa-2048-private.pem'),
       :rsa_public => test_pkey('rsa-2048-public.pem'),
@@ -520,6 +521,14 @@
           end.to raise_error JWT::IncorrectAlgorithm
         end
 
+        context 'invalid header format' do
+          it 'should raise JWT::IncorrectAlgorithm' do
+            expect do
+              JWT.decode data[:invalid_header_token]
+            end.to raise_error JWT::IncorrectAlgorithm
+          end
+        end
+
         context '2-segment token' do
           it 'should raise JWT::IncorrectAlgorithm' do
             expect do