diff --git a/src/base64.h b/src/base64.h
index 64c4e330c0db84..92dc565e65eb1c 100644
--- a/src/base64.h
+++ b/src/base64.h
@@ -60,13 +60,13 @@ size_t base64_decode_slow(char* dst, size_t dstlen,
   size_t k = 0;
   for (;;) {
 #define V(expr)                                                               \
-    while (i < srclen) {                                                      \
+    for (;;) {                                                                \
       const uint8_t c = src[i];                                               \
       lo = unbase64(c);                                                       \
       i += 1;                                                                 \
       if (lo < 64)                                                            \
         break;  /* Legal character. */                                        \
-      if (c == '=')                                                           \
+      if (c == '=' || i >= srclen)                                            \
         return k;                                                             \
     }                                                                         \
     expr;                                                                     \
diff --git a/test/parallel/test-buffer-alloc.js b/test/parallel/test-buffer-alloc.js
index 1a907ba62732db..7f910807917063 100644
--- a/test/parallel/test-buffer-alloc.js
+++ b/test/parallel/test-buffer-alloc.js
@@ -462,6 +462,10 @@ assert.strictEqual(
 // Regression test for https://github.com/nodejs/node/issues/3496.
 assert.strictEqual(Buffer.from('=bad'.repeat(1e4), 'base64').length, 0);
 
+// Regression test for https://github.com/nodejs/node/issues/11987.
+assert.deepStrictEqual(Buffer.from('w0  ', 'base64'),
+                       Buffer.from('w0', 'base64'));
+
 {
   // Creating buffers larger than pool size.
   const l = Buffer.poolSize + 5;