diff --git a/source/credentials_provider_sts_web_identity.c b/source/credentials_provider_sts_web_identity.c
index 5aaafe78..f42244b8 100644
--- a/source/credentials_provider_sts_web_identity.c
+++ b/source/credentials_provider_sts_web_identity.c
@@ -924,6 +924,7 @@ static void s_check_or_get_with_profile_config(
     if ((!(*target) || !(*target)->len)) {
         if (*target) {
             aws_string_destroy(*target);
+            *target = NULL;
         }
         const struct aws_profile_property *property = aws_profile_get_property(profile, config_key);
         if (property) {
diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt
index 1f0aa560..adc2151e 100644
--- a/tests/CMakeLists.txt
+++ b/tests/CMakeLists.txt
@@ -72,6 +72,7 @@ add_test_case(credentials_provider_x509_real_new_destroy)
 add_net_test_case(credentials_provider_sts_web_identity_new_destroy_from_parameters)
 add_net_test_case(credentials_provider_sts_web_identity_new_destroy_from_env)
 add_net_test_case(credentials_provider_sts_web_identity_new_destroy_from_config)
+add_net_test_case(credentials_provider_sts_web_identity_fail_with_empty_config_and_env)
 add_net_test_case(credentials_provider_sts_web_identity_new_destroy_from_cached_config)
 add_net_test_case(credentials_provider_sts_web_identity_new_failed_without_env_and_config)
 add_net_test_case(credentials_provider_sts_web_identity_connect_failure)
diff --git a/tests/credentials_provider_sts_web_identity_tests.c b/tests/credentials_provider_sts_web_identity_tests.c
index 73bf434e..80b18580 100644
--- a/tests/credentials_provider_sts_web_identity_tests.c
+++ b/tests/credentials_provider_sts_web_identity_tests.c
@@ -504,6 +504,48 @@ AWS_TEST_CASE(
     credentials_provider_sts_web_identity_new_destroy_from_config,
     s_credentials_provider_sts_web_identity_new_destroy_from_config);
 
+AWS_STATIC_STRING_FROM_LITERAL(
+    s_basic_config_file,
+    "[profile foo]\n"
+    "region=us-east-1\n");
+
+static int s_credentials_provider_sts_web_identity_fail_with_empty_config_and_env(
+    struct aws_allocator *allocator,
+    void *ctx) {
+    (void)ctx;
+
+    s_aws_sts_web_identity_tester_init(allocator);
+
+    struct aws_byte_buf content_buf = aws_byte_buf_from_c_str(aws_string_c_str(s_basic_config_file));
+
+    struct aws_string *config_file_contents = aws_string_new_from_array(allocator, content_buf.buffer, content_buf.len);
+    ASSERT_TRUE(config_file_contents != NULL);
+    aws_byte_buf_clean_up(&content_buf);
+
+    s_aws_sts_web_identity_test_init_config_profile(allocator, config_file_contents);
+    aws_string_destroy(config_file_contents);
+
+    s_aws_sts_web_identity_test_init_env_parameters(allocator, "", "", "", "");
+
+    struct aws_credentials_provider_sts_web_identity_options options = {
+        .bootstrap = NULL,
+        .tls_ctx = s_tester.tls_ctx,
+        .function_table = &s_mock_function_table,
+        .shutdown_options =
+            {
+                .shutdown_callback = s_on_shutdown_complete,
+                .shutdown_user_data = NULL,
+            },
+    };
+
+    ASSERT_NULL(aws_credentials_provider_new_sts_web_identity(allocator, &options));
+    s_aws_sts_web_identity_tester_cleanup();
+    return 0;
+}
+AWS_TEST_CASE(
+    credentials_provider_sts_web_identity_fail_with_empty_config_and_env,
+    s_credentials_provider_sts_web_identity_fail_with_empty_config_and_env);
+
 static int s_credentials_provider_sts_web_identity_new_destroy_from_cached_config(
     struct aws_allocator *allocator,
     void *ctx) {