@@ -203,7 +203,15 @@ function establishTunnel(agent, socket, options, tunnelConfig, afterSocket) {
         $debug("Propagate free event from tunneled socket to tunnel socket");
         socket.emit("free");
       }
-      tunneledSocket = require("node:tls").connect(requestOptions, onTLSHandshakeSuccess);
+      // https://github.com/nodejs/node/blob/ada8c5c9f82f620885820a2268e19dbf8a2228d5/lib/https.js#L295-L308
+      try {
+        tunneledSocket = require("node:tls").connect(requestOptions, onTLSHandshakeSuccess);
+      } catch (err) {
+        $debug("tls.connect() over tunnel threw", err);
+        socket.destroy();
+        afterSocket(err, socket);
+        return headerEndIndex;
+      }
       tunneledSocket.on("free", onTunneledSocketFree);
       tunneledSocket.on("error", onTLSHandshakeError);
       const agentKey = requestOptions._agentKey;
 
@@ -9,6 +9,7 @@
  */
 
 import { HttpsProxyAgent } from "https-proxy-agent";
+import assert from "node:assert";
 import { once } from "node:events";
 import { readFileSync } from "node:fs";
 import http from "node:http";
@@ -17,6 +18,7 @@ import type { AddressInfo } from "node:net";
 import net from "node:net";
 import { dirname, join } from "node:path";
 import { describe, test } from "node:test";
+import tls from "node:tls";
 import { fileURLToPath } from "node:url";
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
@@ -670,9 +672,256 @@ describe("http.request agent options", () => {
   });
 });
 
+describe(
+  "https.request through a proxy from proxyEnv, with TLS options that tls.connect() rejects",
+  // tls.connect() runs when the proxy has answered the CONNECT, after https.request() returned. nodejs/node#66096 gives
+  // what it throws there to the request. No Node release has that change (v26.10.0 throws it uncaught). It is on Node
+  // main, so v27 runs this block, and on v26.x-staging (33e4ba358b), which is not in a v26 release.
+  { skip: typeof Bun === "undefined" && Number(process.versions.node.split(".")[0]) < 27 },
+  () => {
+    const target = { host: "example.invalid", port: 443, path: "/" };
+    const invalidVersion = { minVersion: "TLSv9" };
+    const rejected = [
+      { name: "minVersion", options: invalidVersion, code: "ERR_TLS_INVALID_PROTOCOL_VERSION" },
+      {
+        name: "wrong passphrase",
+        options: { key: tlsCerts.encryptedKey, cert: tlsCerts.cert, passphrase: "wrong" },
+        code: "ERR_OSSL_BAD_DECRYPT",
+      },
+    ];
+
+    function proxiedAgent(proxyUrl: string, options: https.AgentOptions = {}) {
+      return new https.Agent({ ...options, proxyEnv: { https_proxy: proxyUrl } } as any);
+    }
+
+    // The error that tls.connect() throws for these options when nothing is between it and its caller.
+    function thrownByTlsConnect(options: object) {
+      try {
+        tls.connect({ ...options } as any);
+      } catch (err: any) {
+        return { code: err.code, message: err.message };
+      }
+    }
+
+    // A proxy that answers each CONNECT with 200 and then holds the connection.
+    function createHoldingProxy(scheme: string) {
+      const sockets = new Set<net.Socket>();
+      const connects: string[] = [];
+      // What the client sent after the CONNECT.
+      const afterConnect: Buffer[] = [];
+      // Settles when the first connection is closed. The proxy does not close it, so the client did.
+      const { promise: closed, resolve: onClosed } = Promise.withResolvers<void>();
+
+      function onTunnel(socket: net.Socket) {
+        let head = "";
+        socket.on("error", () => {});
+        socket.on("data", function onHead(chunk: Buffer) {
+          head += chunk.toString("latin1");
+          if (!head.includes("\r\n\r\n")) return;
+          socket.removeListener("data", onHead);
+          connects.push(head.slice(0, head.indexOf("\r\n")));
+          socket.on("data", (chunk: Buffer) => afterConnect.push(chunk));
+          socket.write("HTTP/1.1 200 Connection established\r\n\r\n");
+        });
+      }
+
+      const proxy =
+        scheme === "https"
+          ? tls.createServer({ key: tlsCerts.key, cert: tlsCerts.cert }, onTunnel)
+          : net.createServer(onTunnel);
+      // The TCP connection, for an https proxy too.
+      proxy.on("connection", (socket: net.Socket) => {
+        sockets.add(socket);
+        socket.on("close", () => {
+          sockets.delete(socket);
+          onClosed();
+        });
+      });
+
+      function close() {
+        for (const socket of sockets) socket.destroy();
+        proxy.close();
+      }
+      return { proxy, connects, afterConnect, closed, close };
+    }
+
+    // What the request emits, in order, up to and including its 'close'.
+    function eventsOf(req: http.ClientRequest) {
+      const events: unknown[] = [];
+      const { promise, resolve } = Promise.withResolvers<unknown[]>();
+      req.on("socket", () => events.push("socket"));
+      req.on("response", res => {
+        events.push(`response ${res.statusCode}`);
+        res.resume();
+      });
+      req.on("timeout", () => events.push("timeout"));
+      req.on("error", (err: NodeJS.ErrnoException) => events.push({ code: err.code, message: err.message }));
+      req.on("close", () => {
+        events.push("close");
+        resolve(events);
+      });
+      return promise;
+    }
+
+    for (const scheme of ["http", "https"]) {
+      for (const { name, options, code } of scheme === "http" ? rejected : rejected.slice(0, 1)) {
+        test(`${scheme} proxy: ${name}`, async () => {
+          const defaults = scheme === "https" ? tls.getCACertificates("default") : undefined;
+          const { proxy, connects, closed, close } = createHoldingProxy(scheme);
+          const agent = proxiedAgent(`${scheme}://127.0.0.1:${await startProxy(proxy)}`);
+          try {
+            // The client has to trust the certificate of an https proxy.
+            if (defaults) tls.setDefaultCACertificates([...defaults, tlsCerts.cert]);
+            const expected = { code, message: thrownByTlsConnect(options)?.message };
+            const req = https.get({ ...target, agent, ...options } as any);
+            assert.deepStrictEqual(await eventsOf(req), [expected, "close"]);
+            await closed;
+            assert.deepStrictEqual(connects, ["CONNECT example.invalid:443 HTTP/1.1"]);
+          } finally {
+            agent.destroy();
+            close();
+            if (defaults) tls.setDefaultCACertificates(defaults);
+          }
+        });
+      }
+    }
+
+    test("agent.createConnection() gives its callback the error and the closed proxy socket", async () => {
+      const { proxy, closed, close } = createHoldingProxy("http");
+      const agent = proxiedAgent(`http://127.0.0.1:${await startProxy(proxy)}`);
+      try {
+        const calls: unknown[] = [];
+        const { promise: called, resolve: onCalled } = Promise.withResolvers<void>();
+        const proxySocket = (agent as any).createConnection(
+          { ...target, ...invalidVersion },
+          (err: NodeJS.ErrnoException, socket: net.Socket) => {
+            calls.push({ code: err.code, proxySocket: socket === proxySocket, destroyed: socket.destroyed });
+            onCalled();
+          },
+        );
+        await called;
+        assert.deepStrictEqual(calls, [
+          { code: "ERR_TLS_INVALID_PROTOCOL_VERSION", proxySocket: true, destroyed: true },
+        ]);
+        await closed;
+      } finally {
+        agent.destroy();
+        close();
+      }
+    });
+
+    test("a falsy value thrown by tls.connect(): the proxy gets nothing of the request", async () => {
+      const { proxy, connects, afterConnect, closed, close } = createHoldingProxy("http");
+      const agent = proxiedAgent(`http://127.0.0.1:${await startProxy(proxy)}`);
+      try {
+        // agent.getName() reads the key too: throw at the first read after the CONNECT, which is tls.connect()'s.
+        let thrown = false;
+        const key = [
+          {
+            get pem() {
+              if (connects.length === 0 || thrown) return tlsCerts.key;
+              thrown = true;
+              throw null;
+            },
+          },
+        ];
+        const req = https.request({ ...target, agent, method: "POST", key } as any);
+        const events = eventsOf(req);
+        req.end("for the target only");
+        // The Agent takes a falsy error for success. The socket that it gives the request is closed.
+        const [socket] = await once(req, "socket");
+        assert.strictEqual(socket.destroyed, true);
+        assert.deepStrictEqual(await events, ["socket", { code: "ECONNRESET", message: "socket hang up" }, "close"]);
+        await closed;
+        assert.strictEqual(Buffer.concat(afterConnect).toString("latin1"), "");
+      } finally {
+        agent.destroy();
+        close();
+      }
+    });
+
+    test("a request that waited behind maxTotalSockets", async () => {
+      const { server, port, hostname } = await createHttpsServer();
+      const proxy = createConnectProxy();
+      let tunnels = 0;
+      proxy.on("connection", () => tunnels++);
+      const agent = proxiedAgent(`http://127.0.0.1:${await startProxy(proxy)}`, {
+        ca: tlsCerts.ca,
+        maxTotalSockets: 1,
+      });
+      try {
+        const request = { hostname, port, path: "/", agent };
+        const first = https.get(request);
+        const firstEvents = eventsOf(first);
+        // The Agent counts the socket of a tunnel from when the tunnel is there. Later requests then wait.
+        await once(first, "socket");
+        const rejectedEvents = eventsOf(https.get({ ...request, ...invalidVersion } as any));
+        const lastEvents = eventsOf(https.get(request));
+        assert.strictEqual(Object.values(agent.requests).flat().length, 2);
+
+        assert.deepStrictEqual(await rejectedEvents, [thrownByTlsConnect(invalidVersion), "close"]);
+        assert.deepStrictEqual(await firstEvents, ["socket", "response 200", "close"]);
+        assert.deepStrictEqual(await lastEvents, ["socket", "response 200", "close"]);
+        assert.strictEqual(tunnels, 3);
+      } finally {
+        agent.destroy();
+        server.close();
+        proxy.close();
+      }
+    });
+  },
+);
+
 // Only run in Bun to avoid infinite loop when Node.js runs this file
 if (typeof Bun !== "undefined") {
-  const { bunEnv, nodeExe } = await import("harness");
+  const { bunEnv, bunExe, nodeExe } = await import("harness");
+
+  describe("https.request through a proxy from NODE_USE_ENV_PROXY=1", () => {
+    test("the request gets what tls.connect() throws, and the process exits", async () => {
+      // Answers each CONNECT with 200 and then holds the connection.
+      const sockets = new Set<net.Socket>();
+      const proxy = net.createServer(socket => {
+        sockets.add(socket);
+        socket.on("error", () => {});
+        socket.once("data", () => socket.write("HTTP/1.1 200 Connection established\r\n\r\n"));
+      });
+      const port = await startProxy(proxy);
+      try {
+        // The global agent takes the proxy from the environment when node:https loads.
+        const script = `
+          const events = [];
+          const req = require("node:https").get("https://example.invalid/", { minVersion: "TLSv9" });
+          req.on("error", err => events.push(err.code));
+          req.on("close", () => {
+            events.push("close");
+            console.log(JSON.stringify(events));
+          });
+        `;
+        await using proc = Bun.spawn({
+          cmd: [bunExe(), "-e", script],
+          env: {
+            ...bunEnv,
+            NODE_USE_ENV_PROXY: "1",
+            HTTPS_PROXY: `http://127.0.0.1:${port}`,
+            https_proxy: undefined,
+            NO_PROXY: undefined,
+            no_proxy: undefined,
+          },
+          stdout: "pipe",
+          stderr: "pipe",
+        });
+        const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+        // The proxy holds the connection. The process can only exit when the client closed it.
+        assert.deepStrictEqual(
+          { stdout: stdout.trim(), stderr, exitCode },
+          { stdout: JSON.stringify(["ERR_TLS_INVALID_PROTOCOL_VERSION", "close"]), stderr: "", exitCode: 0 },
+        );
+      } finally {
+        for (const socket of sockets) socket.destroy();
+        proxy.close();
+      }
+    });
+  });
 
   describe("Node.js compatibility", () => {
     test("all tests pass in Node.js", async () => {
 
@@ -0,0 +1,75 @@
+// This tests that invalid TLS options do not result in an uncaught exception
+// after an HTTPS proxy tunnel has been established.
+
+import * as common from '../common/index.mjs';
+import assert from 'node:assert';
+import { once } from 'events';
+import fixtures from '../common/fixtures.js';
+import { createProxyServer } from '../common/proxy-server.js';
+
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+// https must be dynamically imported so that builds without crypto support
+// can skip it.
+const { default: https } = await import('node:https');
+
+const server = https.createServer({
+  cert: fixtures.readKey('agent8-cert.pem'),
+  key: fixtures.readKey('agent8-key.pem'),
+}, common.mustNotCall());
+server.on('error', common.mustNotCall());
+server.listen(0);
+await once(server, 'listening');
+
+const { proxy, logs } = createProxyServer();
+proxy.listen(0);
+await once(proxy, 'listening');
+
+const serverHost = `localhost:${server.address().port}`;
+
+// tls.connect() throws for these options while building the secure context,
+// before any handshake happens.
+const testCases = [
+  { options: { minVersion: 'definitely-invalid' }, code: 'ERR_TLS_INVALID_PROTOCOL_VERSION' },
+  { options: { ciphers: 123 }, code: 'ERR_INVALID_ARG_TYPE' },
+  { options: { secureProtocol: 'definitely-invalid' }, code: 'ERR_TLS_INVALID_PROTOCOL_METHOD' },
+];
+
+for (const { options, code } of testCases) {
+  const agent = new https.Agent({
+    ca: fixtures.readKey('fake-startcom-root-cert.pem'),
+    proxyEnv: {
+      HTTPS_PROXY: `http://localhost:${proxy.address().port}`,
+    },
+  });
+  const req = https.get({
+    host: 'localhost',
+    port: server.address().port,
+    path: '/test',
+    agent,
+    ...options,
+  }, common.mustNotCall());
+  const [err] = await once(req, 'error');
+  assert.strictEqual(err.code, code);
+  agent.destroy();
+}
+
+// Verify that the requests went through the proxy and the tunnel was established.
+const requests = logs.filter((log) => !('error' in log));
+// The client resets the tunnel as soon as tls.connect() throws, which the
+// proxy may observe as an ECONNRESET while still relaying it.
+const errors = logs.filter((log) =>
+  'error' in log && log.error.code !== 'ECONNRESET');
+
+assert.deepStrictEqual(requests, testCases.map(() => ({
+  method: 'CONNECT',
+  url: serverHost,
+  headers: {
+    'host': serverHost,
+  },
+})));
+assert.deepStrictEqual(errors, []);
+
+proxy.close();
+server.close();