diff --git a/lib/tls.js b/lib/tls.js
index a435d3880c..c62d40f8f3 100644
--- a/lib/tls.js
+++ b/lib/tls.js
@@ -1252,7 +1252,7 @@ exports.connect = function(/* [port, host], options, cb */) {
 
   var cleartext = pipe(pair, socket);
   if (cb) {
-    cleartext.on('secureConnect', cb);
+    cleartext.once('secureConnect', cb);
   }
 
   if (!options.socket) {
diff --git a/test/pummel/test-tls-connect-memleak.js b/test/pummel/test-tls-connect-memleak.js
new file mode 100644
index 0000000000..3454b6d668
--- /dev/null
+++ b/test/pummel/test-tls-connect-memleak.js
@@ -0,0 +1,56 @@
+// Copyright Joyent, Inc. and other Node contributors.
+//
+// Permission is hereby granted, free of charge, to any person obtaining a
+// copy of this software and associated documentation files (the
+// "Software"), to deal in the Software without restriction, including
+// without limitation the rights to use, copy, modify, merge, publish,
+// distribute, sublicense, and/or sell copies of the Software, and to permit
+// persons to whom the Software is furnished to do so, subject to the
+// following conditions:
+//
+// The above copyright notice and this permission notice shall be included
+// in all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
+// NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
+// DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+// USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+// Flags: --expose-gc
+
+var common = require('../common');
+var assert = require('assert');
+var tls = require('tls');
+var fs = require('fs');
+
+assert(typeof gc === 'function', 'Run this test with --expose-gc');
+
+tls.createServer({
+  cert: fs.readFileSync(common.fixturesDir + '/test_cert.pem'),
+  key: fs.readFileSync(common.fixturesDir + '/test_key.pem')
+}).listen(common.PORT);
+
+(function() {
+  // 2**26 == 64M entries
+  for (var i = 0, junk = [123.456]; i < 26; ++i) junk = junk.concat(junk);
+
+  var options = { rejectUnauthorized: false };
+  tls.connect(common.PORT, '127.0.0.1', options, function() {
+    assert(junk.length != 0);  // keep reference alive
+    setTimeout(done, 10);
+    gc();
+  });
+})();
+
+function done() {
+  var before = process.memoryUsage().rss;
+  gc();
+  var after = process.memoryUsage().rss;
+  var reclaimed = (before - after) / 1024;
+  console.log('%d kB reclaimed', reclaimed);
+  assert(reclaimed > 256 * 1024);  // it's more like 512M on x64
+  process.exit();
+}