diff --git a/doc/api/crypto.md b/doc/api/crypto.md
index 35c15a7748ecc5..2a699ae73b5871 100644
--- a/doc/api/crypto.md
+++ b/doc/api/crypto.md
@@ -1821,6 +1821,9 @@ Creates and returns a new key object containing a private key. If `key` is a
 string or `Buffer`, `format` is assumed to be `'pem'`; otherwise, `key`
 must be an object with the properties described above.
 
+If the private key is encrypted, a `passphrase` must be specified. The length
+of the passphrase is limited.
+
 ### crypto.createPublicKey(key)
 <!-- YAML
 added: v11.6.0
diff --git a/src/node_crypto.cc b/src/node_crypto.cc
index 00c439d2f05d4c..13eb34a350ac7a 100644
--- a/src/node_crypto.cc
+++ b/src/node_crypto.cc
@@ -178,7 +178,8 @@ static int PasswordCallback(char* buf, int size, int rwflag, void* u) {
   if (passphrase != nullptr) {
     size_t buflen = static_cast<size_t>(size);
     size_t len = strlen(passphrase);
-    len = len > buflen ? buflen : len;
+    if (buflen <= len)
+      return -1;
     memcpy(buf, passphrase, len);
     return len;
   }
diff --git a/test/parallel/test-crypto-key-objects.js b/test/parallel/test-crypto-key-objects.js
index e8f6cc3c963d46..fac51413881fc8 100644
--- a/test/parallel/test-crypto-key-objects.js
+++ b/test/parallel/test-crypto-key-objects.js
@@ -223,6 +223,17 @@ const privateDsa = fixtures.readKey('dsa_private_encrypted_1025.pem',
     message: 'Passphrase required for encrypted key'
   });
 
+  // Reading an encrypted key with a passphrase that exceeds OpenSSL's buffer
+  // size limit should fail with an appropriate error code.
+  common.expectsError(() => createPrivateKey({
+    key: privateDsa,
+    format: 'pem',
+    passphrase: Buffer.alloc(16 * 1024, 'a')
+  }), {
+    code: 'ERR_OSSL_PEM_BAD_PASSWORD_READ',
+    type: Error
+  });
+
   const publicKey = createPublicKey(publicDsa);
   assert.strictEqual(publicKey.type, 'public');
   assert.strictEqual(publicKey.asymmetricKeyType, 'dsa');