diff --git a/include/rfb.js b/include/rfb.js
index 365c513c982963d93407c7ece1c59d199d0c6a31..d0f59b8baa09dcec1fbcf6acbe07e31683a348d7 100644
--- a/include/rfb.js
+++ b/include/rfb.js
@@ -797,6 +797,11 @@ init_msg = function() {
             case 1:  // failed
                 if (rfb_version >= 3.8) {
                     reason_len = rQshift32();
+                    if (rQlen() < reason_len) {
+                        Util.Debug("   waiting for SecurityResult reason bytes");
+                        rQi -= 8; // Unshift the status and length
+                        return;
+                    }
                     reason = rQshiftStr(reason_len);
                     updateState('failed', reason);
                 } else {