diff --git a/lib/resty/jwt.lua b/lib/resty/jwt.lua
index f3fe86c..b3214a0 100644
--- a/lib/resty/jwt.lua
+++ b/lib/resty/jwt.lua
@@ -330,7 +330,7 @@ local function parse_jwe(self, preshared_key, encoded_header, encoded_encrypted_
     error({reason="unsupported payload encryption algorithm :" .. tostring(header.enc)})
   end
 
-  local key, enc_key
+  local key, enc_key, _
   if alg == str_const.DIR then
     -- RFC 7516 5.2 step 11: direct encryption uses an empty encrypted key
     if encoded_encrypted_key ~= str_const.empty then
@@ -582,7 +582,7 @@ local function sign_jwe(self, secret_key, jwt_obj)
   end
 
   -- TODO: implement logic for creating enc key and mac key and then encrypt key
-  local key, encrypted_key, mac_key, enc_key
+  local key, encrypted_key, mac_key, enc_key, _
   local encoded_header = _M:jwt_encode(header)
   local payload_to_encrypt = get_payload_encoder(self)(jwt_obj.payload)
   if alg ==  str_const.DIR then
diff --git a/t/jwe-integrity.t b/t/jwe-integrity.t
index 65519d2..7f6e333 100644
--- a/t/jwe-integrity.t
+++ b/t/jwe-integrity.t
@@ -318,3 +318,27 @@ A128CBC-HS256: true everything is awesome~ :p | false Claim 'foo' ('bar') return
 A256GCM: true everything is awesome~ :p | false Claim 'foo' ('bar') returned failure
 --- no_error_log
 [error]
+
+
+
+=== TEST 10: JWE operations do not overwrite the worker global underscore
+--- http_config eval: $::HttpConfig
+--- config
+    location /t {
+        content_by_lua_block {
+            local jwt = require "resty.jwt"
+            local sentinel = {}
+            rawset(_G, "_", sentinel)
+
+            local token = jwe_t.sign("A128CBC-HS256")
+            local obj = jwt:verify(jwe_t.keys["A128CBC-HS256"], token)
+
+            ngx.say(obj.verified, " ", rawget(_G, "_") == sentinel)
+        }
+    }
+--- request
+GET /t
+--- response_body
+true true
+--- no_error_log
+[error]