Every Lightning invoice decoder on npm accepts invoices the spec says a reader MUST fail.
I ran BOLT-11's own example vectors against all four:
[email protected] — 22/24
[email protected] — 22/24
...
the payment_secret gap is the real one. every wallet we've tested since 2022 sends it, but if a decoder silently accepts invoices without it, you're exposed to a specific theft vector. 'MUST fail' on unknown even feature bits is similar.