diff --git a/lib/hx509/req.c b/lib/hx509/req.c
index 768dfdaf1..73db4d67b 100644
--- a/lib/hx509/req.c
+++ b/lib/hx509/req.c
@@ -723,6 +723,7 @@ hx509_request_parse_der(hx509_context context,
     if (ret) {
         hx509_set_error_string(context, 0, ret, "Failed to decode CSR");
         free(*req);
+        *req = NULL;
         return ret;
     }
     rinfo = &r.certificationRequestInfo;