diff --git a/src/inlines.c b/src/inlines.c
index bf765eab5..3805df50a 100644
--- a/src/inlines.c
+++ b/src/inlines.c
@@ -1102,9 +1102,15 @@ static bufsize_t manual_scan_link_url(cmark_chunk *input, bufsize_t offset,
       if (input->data[i] == '>') {
         ++i;
         break;
-      } else if (input->data[i] == '\\')
-        i += 2;
-      else if (input->data[i] == '\n' || input->data[i] == '<')
+      } else if (input->data[i] == '\\') {
+        // a backslash escape may cover the next character, but it cannot
+        // smuggle a line ending into the destination, which is forbidden
+        // inside pointy brackets.
+        if (i + 1 < input->len && input->data[i + 1] != '\n')
+          i += 2;
+        else
+          return -1;
+      } else if (input->data[i] == '\n' || input->data[i] == '<')
         return -1;
       else
         ++i;
diff --git a/test/regression.txt b/test/regression.txt
index 1426617ab..052a9ab12 100644
--- a/test/regression.txt
+++ b/test/regression.txt
@@ -349,3 +349,13 @@ break, not a paragraph.
 <hr />
 <p><a href="/url">foo</a></p>
 ````````````````````````````````
+
+A pointy-bracket link destination may not contain a line ending, even
+when the newline is preceded by a backslash.
+```````````````````````````````` example
+[a](<b\
+c>)
+.
+<p>[a](&lt;b<br />
+c&gt;)</p>
+````````````````````````````````