diff --git a/nvm.sh b/nvm.sh
index 6b1d6eaf..f8d6f0dd 100755
--- a/nvm.sh
+++ b/nvm.sh
@@ -217,8 +217,10 @@ nvm_sanitize_auth_header() {
     # `Basic <base64>` and `Bearer <token>` survive intact.
     # '~' is also allowed, completing RFC 7235 `token68` (and thus RFC 6750
     # `b64token`), so opaque Bearer tokens containing it are not corrupted.
-    # Note: '-' must be at the end of the bracket expression to be treated as a literal.
-    nvm_echo "$1" | command sed 's/[^a-zA-Z0-9 :_.+/=~-]//g'
+    # Note: '-' must be at the end of the set to be treated as a literal.
+    # `tr`, not `sed`: sed is line-based and would keep newlines, eg from a
+    # `base64` credential that was wrapped at 76 columns.
+    nvm_echo "$1" | command tr -cd 'a-zA-Z0-9 :_.+/=~-'
 }
 
 nvm_has_system_node() {
diff --git a/test/fast/Unit tests/nvm_sanitize_auth_header b/test/fast/Unit tests/nvm_sanitize_auth_header
index d7ea8192..731310e5 100755
--- a/test/fast/Unit tests/nvm_sanitize_auth_header	
+++ b/test/fast/Unit tests/nvm_sanitize_auth_header	
@@ -49,4 +49,13 @@ B64TOKEN="Bearer mF_9.B5f-4.1JqM~+/="
 RESULT=$(nvm_sanitize_auth_header "${B64TOKEN}")
 [ "${RESULT}" = "${B64TOKEN}" ] || die "FAIL: b64token chars were stripped. Got: '${RESULT}'"
 
+# Test 8: a `Basic` credential that `base64` wrapped at 76 columns is rejoined into one line
+WRAPPED="Basic $(printf 'YS1yYXRoZXItbG9uZy11c2VybmFtZUBleGFtcGxlLmNvbTphbi1ldmVuLWxvbmdlci1wYXNzd29y\nZCE=')"
+RESULT=$(nvm_sanitize_auth_header "${WRAPPED}")
+[ "${RESULT}" = "Basic YS1yYXRoZXItbG9uZy11c2VybmFtZUBleGFtcGxlLmNvbTphbi1ldmVuLWxvbmdlci1wYXNzd29yZCE=" ] || die "FAIL: wrapped base64 credential was not rejoined. Got: '${RESULT}'"
+
+# Test 9: CR, LF, and blank lines are all removed
+RESULT=$(nvm_sanitize_auth_header "$(printf 'Bearer a\r\nb\n\nc')")
+[ "${RESULT}" = "Bearer abc" ] || die "FAIL: line breaks survived sanitization. Got: '${RESULT}'"
+
 echo "All nvm_sanitize_auth_header tests passed"