diff --git a/lib/tls.js b/lib/tls.js
index e396b592e80..68e860f0d1d 100644
--- a/lib/tls.js
+++ b/lib/tls.js
@@ -77,6 +77,42 @@ function convertNPNProtocols(NPNProtocols, out) {
   }
 }
 
+
+function SlabBuffer() {
+  this.create();
+};
+
+
+SlabBuffer.prototype.create = function create() {
+  this.isFull = false;
+  this.pool = new Buffer(10 * 1024 * 1024);
+  this.offset = 0;
+  this.remaining = this.pool.length;
+};
+
+
+SlabBuffer.prototype.use = function use(context, fn) {
+  if (this.remaining === 0) {
+    this.isFull = true;
+    return 0;
+  }
+
+  var bytes = fn.call(context, this.pool, this.offset, this.remaining);
+
+  if (bytes > 0) {
+    this.offset += bytes;
+    this.remaining -= bytes;
+  }
+
+  assert(this.remaining >= 0);
+
+  return bytes;
+};
+
+
+var slabBuffer = new SlabBuffer();
+
+
 // Base class of both CleartextStream and EncryptedStream
 function CryptoStream(pair) {
   Stream.call(this);
@@ -90,6 +126,7 @@ function CryptoStream(pair) {
   this._pending = [];
   this._pendingCallbacks = [];
   this._pendingBytes = 0;
+  this._buffer = slabBuffer;
 }
 util.inherits(CryptoStream, Stream);
 
@@ -339,18 +376,13 @@ CryptoStream.prototype._push = function() {
   }
 
   while (!this._paused) {
-    var chunkBytes = 0;
-    if (!this._pool || (this._poolStart >= this._poolEnd)) {
-      this._pool = new Buffer(16 * 4096);
-      this._poolStart = 0;
-      this._poolEnd = this._pool.length;
-    }
-    var start = this._poolStart;
+    var chunkBytes = 0,
+        bytesRead = 0,
+        start = this._buffer.offset;
 
     do {
-      chunkBytes = this._pusher(this._pool,
-                                this._poolStart,
-                                this._poolEnd - this._poolStart);
+      chunkBytes = this._buffer.use(this, this._pusher);
+      if (chunkBytes > 0) bytesRead += chunkBytes;
 
       if (this.pair.ssl && this.pair.ssl.error) {
         this.pair.error();
@@ -359,13 +391,12 @@ CryptoStream.prototype._push = function() {
 
       this.pair.maybeInitFinished();
 
-      if (chunkBytes >= 0) {
-        this._poolStart += chunkBytes;
-      }
+    } while (chunkBytes > 0 && !this._buffer.isFull);
 
-    } while (chunkBytes > 0 && this._poolStart < this._poolEnd);
+    var pool = this._buffer.pool;
 
-    var bytesRead = this._poolStart - start;
+    // Create new buffer if previous was filled up
+    if (this._buffer.isFull) this._buffer.create();
 
     assert(bytesRead >= 0);
 
@@ -377,7 +408,7 @@ CryptoStream.prototype._push = function() {
       return;
     }
 
-    var chunk = this._pool.slice(start, this._poolStart);
+    var chunk = pool.slice(start, start + bytesRead);
 
     if (this === this.pair.cleartext) {
       debug('cleartext emit "data" with ' + bytesRead + ' bytes');
@@ -393,7 +424,7 @@ CryptoStream.prototype._push = function() {
     }
 
     // Optimization: emit the original buffer with end points
-    if (this.ondata) this.ondata(this._pool, start, this._poolStart);
+    if (this.ondata) this.ondata(pool, start, start + bytesRead);
   }
 };