diff --git a/encoding/jsonpb/decode.go b/encoding/jsonpb/decode.go
index 4b46ffc..4b0d9bb 100644
--- a/encoding/jsonpb/decode.go
+++ b/encoding/jsonpb/decode.go
@@ -376,7 +376,11 @@
 
 	case json.String:
 		// Decode number from string.
-		dec := json.NewDecoder([]byte(jval.String()))
+		s := strings.TrimSpace(jval.String())
+		if len(s) != len(jval.String()) {
+			return pref.Value{}, errors.New("invalid number %v", jval.Raw())
+		}
+		dec := json.NewDecoder([]byte(s))
 		var nerr errors.NonFatal
 		jval, err := dec.Read()
 		if !nerr.Merge(err) {
@@ -405,7 +409,11 @@
 
 	case json.String:
 		// Decode number from string.
-		dec := json.NewDecoder([]byte(jval.String()))
+		s := strings.TrimSpace(jval.String())
+		if len(s) != len(jval.String()) {
+			return pref.Value{}, errors.New("invalid number %v", jval.Raw())
+		}
+		dec := json.NewDecoder([]byte(s))
 		var nerr errors.NonFatal
 		jval, err := dec.Read()
 		if !nerr.Merge(err) {
@@ -452,6 +460,9 @@
 			return pref.ValueOf(math.Inf(-1)), nil
 		}
 		// Decode number from string.
+		if len(s) != len(strings.TrimSpace(s)) {
+			return pref.Value{}, errors.New("invalid number %v", jval.Raw())
+		}
 		dec := json.NewDecoder([]byte(s))
 		var nerr errors.NonFatal
 		jval, err := dec.Read()
diff --git a/encoding/jsonpb/decode_test.go b/encoding/jsonpb/decode_test.go
index 9fb95d6..6226b07 100644
--- a/encoding/jsonpb/decode_test.go
+++ b/encoding/jsonpb/decode_test.go
@@ -253,6 +253,16 @@
 			SDouble: math.Inf(-1),
 		},
 	}, {
+		desc:         "float string with leading space",
+		inputMessage: &pb3.Scalars{},
+		inputText:    `{"sFloat": " 1.234"}`,
+		wantErr:      true,
+	}, {
+		desc:         "double string with trailing space",
+		inputMessage: &pb3.Scalars{},
+		inputText:    `{"sDouble": "5.678 "}`,
+		wantErr:      true,
+	}, {
 		desc:         "not float",
 		inputMessage: &pb3.Scalars{},
 		inputText:    `{"sFloat": true}`,
@@ -324,6 +334,16 @@
 			SInt32: 12,
 		},
 	}, {
+		desc:         "integer string with leading space",
+		inputMessage: &pb3.Scalars{},
+		inputText:    `{"sInt32": " 1234"}`,
+		wantErr:      true,
+	}, {
+		desc:         "integer string with trailing space",
+		inputMessage: &pb3.Scalars{},
+		inputText:    `{"sUint32": "1e2 "}`,
+		wantErr:      true,
+	}, {
 		desc:         "number is not an integer",
 		inputMessage: &pb3.Scalars{},
 		inputText:    `{"sInt32": 1.001}`,