diff --git a/mongoose.c b/mongoose.c
index 6291e4ef..28fb22c0 100644
--- a/mongoose.c
+++ b/mongoose.c
@@ -4718,7 +4718,8 @@ long mg_io_send(struct mg_connection *c, const void *buf, size_t len) {
 }
 
 static void handle_tls_recv(struct mg_connection *c) {
-  size_t min = 512;
+  size_t avail = mg_tls_pending(c); 
+  size_t min = avail > MG_MAX_RECV_SIZE ? MG_MAX_RECV_SIZE : avail;
   struct mg_iobuf *io = &c->recv;
   if (io->size - io->len < min && !mg_iobuf_resize(io, io->len + min)) {
     mg_error(c, "oom");
@@ -4731,7 +4732,7 @@ static void handle_tls_recv(struct mg_connection *c) {
       // Decrypted successfully - trigger MG_EV_READ
       io->len += (size_t) n;
       mg_call(c, MG_EV_READ, &n);
-    }
+    } // else n < 0: outstanding data to be moved to c->recv
   }
 }
 
@@ -11334,7 +11335,8 @@ long mg_tls_recv(struct mg_connection *c, void *buf, size_t len) {
 }
 
 size_t mg_tls_pending(struct mg_connection *c) {
-  return mg_tls_got_record(c) ? 1 : 0;
+  struct tls_data *tls = (struct tls_data *) c->tls;
+  return tls != NULL ? tls->recv_len : 0;
 }
 
 void mg_tls_ctx_init(struct mg_mgr *mgr) {
diff --git a/src/net_builtin.c b/src/net_builtin.c
index 31723c2a..57b40176 100644
--- a/src/net_builtin.c
+++ b/src/net_builtin.c
@@ -642,7 +642,8 @@ long mg_io_send(struct mg_connection *c, const void *buf, size_t len) {
 }
 
 static void handle_tls_recv(struct mg_connection *c) {
-  size_t min = 512;
+  size_t avail = mg_tls_pending(c); 
+  size_t min = avail > MG_MAX_RECV_SIZE ? MG_MAX_RECV_SIZE : avail;
   struct mg_iobuf *io = &c->recv;
   if (io->size - io->len < min && !mg_iobuf_resize(io, io->len + min)) {
     mg_error(c, "oom");
@@ -655,7 +656,7 @@ static void handle_tls_recv(struct mg_connection *c) {
       // Decrypted successfully - trigger MG_EV_READ
       io->len += (size_t) n;
       mg_call(c, MG_EV_READ, &n);
-    }
+    } // else n < 0: outstanding data to be moved to c->recv
   }
 }
 
diff --git a/src/tls_builtin.c b/src/tls_builtin.c
index c2ee156d..a2c4804a 100644
--- a/src/tls_builtin.c
+++ b/src/tls_builtin.c
@@ -1390,7 +1390,8 @@ long mg_tls_recv(struct mg_connection *c, void *buf, size_t len) {
 }
 
 size_t mg_tls_pending(struct mg_connection *c) {
-  return mg_tls_got_record(c) ? 1 : 0;
+  struct tls_data *tls = (struct tls_data *) c->tls;
+  return tls != NULL ? tls->recv_len : 0;
 }
 
 void mg_tls_ctx_init(struct mg_mgr *mgr) {