diff --git a/security/nss/lib/util/utilpars.c b/security/nss/lib/util/utilpars.c
index f9b807f7ed..779a991095 100644
--- a/security/nss/lib/util/utilpars.c
+++ b/security/nss/lib/util/utilpars.c
@@ -913,6 +913,23 @@ NSSUTIL_MkModuleSpec(char *dllName, char *commonName, char *parameters,
     return NSSUTIL_MkModuleSpecEx(dllName, commonName, parameters, NSS, NULL);
 }
 
+/* Count the number of name=value parameters in a parameter string. */
+static size_t
+nssutil_CountParams(const char *params)
+{
+    size_t count = 0;
+    const char *p = params;
+    while (*p) {
+        p = NSSUTIL_ArgStrip(p);
+        if (!*p) {
+            break;
+        }
+        p = NSSUTIL_ArgSkipParameter(p);
+        count++;
+    }
+    return count;
+}
+
 /************************************************************************
  * add a single flag to the Flags= section inside the spec's NSS= section */
 char *
@@ -946,7 +963,11 @@ NSSUTIL_AddNSSFlagToModuleSpec(char *spec, char *addFlag)
     } else {
         const char *iNss = nss;
         PRBool alreadyAdded = PR_FALSE;
-        size_t maxSize = strlen(nss) + strlen(addFlag) + prefixLen + 2; /* space and null terminator */
+        // Allocate enough space for the current string, space delimiters
+        // between all existing parameters, a space before the new flags
+        // parameter, and a null terminator.
+        size_t nParams = nssutil_CountParams(nss);
+        size_t maxSize = strlen(nss) + nParams + strlen(addFlag) + prefixLen + 2;
         nss2 = PORT_Alloc(maxSize);
         *nss2 = 0;
         while (*iNss) {