As stated in the docs:

maxAge: the maximum allowed age for tokens to still be valid. Currently it is expressed in milliseconds or a string describing a time span zeit/ms. Eg: 1000, "2 days", "10h", "7d". (...)

But if you pass a number, it's converted to string by ms call here, as there's no typeof check for options.maxAge. Because of this all the following validation logic is broken in this case.