diff --git a/doc/sources/nghttpx-howto.rst b/doc/sources/nghttpx-howto.rst
index 09f3e605..894180e4 100644
--- a/doc/sources/nghttpx-howto.rst
+++ b/doc/sources/nghttpx-howto.rst
@@ -269,10 +269,11 @@ time:
 
 We can use ``*`` in the left most position of host to achieve wildcard
 suffix match.  If ``*`` is the left most character, then the remaining
-string should match the request host suffix.  For example,
-``*.example.com`` matches ``www.example.com`` and ``dev.example.com``,
-and does not match ``example.com`` and ``nghttp2.org``.  The exact
-match (without ``*``) always takes precedence over wildcard match.
+string should match the request host suffix.  ``*`` must match at
+least one character.  For example, ``*.example.com`` matches
+``www.example.com`` and ``dev.example.com``, and does not match
+``example.com`` and ``nghttp2.org``.  The exact match (without ``*``)
+always takes precedence over wildcard match.
 
 One important thing you have to remember is that we have to specify
 default routing pattern for so called "catch all" pattern.  To write
diff --git a/src/shrpx.cc b/src/shrpx.cc
index 8d2100b8..40298537 100644
--- a/src/shrpx.cc
+++ b/src/shrpx.cc
@@ -1225,10 +1225,11 @@ Connections:
 
               Host  can  include "*"  in  the  left most  position  to
               indicate  wildcard match  (only suffix  match is  done).
-              For  example,  host pattern  "*www.nghttp2.org"  matches
-              against  "www.nghttp2.org"  and  "1www.ngttp2.org",  but
-              does not  match against "nghttp2.org".  The  exact hosts
-              match takes precedence over the wildcard hosts match.
+              The "*" must match at least one character.  For example,
+              host    pattern    "*.nghttp2.org"    matches    against
+              "www.nghttp2.org"  and  "git.ngttp2.org", but  does  not
+              match  against  "nghttp2.org".   The exact  hosts  match
+              takes precedence over the wildcard hosts match.
 
               If <PATTERN> is omitted or  empty string, "/" is used as
               pattern,  which  matches  all request  paths  (catch-all
diff --git a/src/shrpx_worker.cc b/src/shrpx_worker.cc
index 601c8143..13f84eb8 100644
--- a/src/shrpx_worker.cc
+++ b/src/shrpx_worker.cc
@@ -321,7 +321,9 @@ size_t match_downstream_addr_group_host(
 
   for (auto it = std::begin(wildcard_patterns);
        it != std::end(wildcard_patterns); ++it) {
-    if (!util::ends_with(std::begin(host), std::end(host),
+    /* left most '*' must match at least one character */
+    if (host.size() <= (*it).host.size() ||
+        !util::ends_with(std::begin(host), std::end(host),
                          std::begin((*it).host), std::end((*it).host))) {
       continue;
     }
diff --git a/src/shrpx_worker_test.cc b/src/shrpx_worker_test.cc
index ae2f0e80..cd840f9e 100644
--- a/src/shrpx_worker_test.cc
+++ b/src/shrpx_worker_test.cc
@@ -188,7 +188,7 @@ void test_shrpx_worker_match_downstream_addr_group(void) {
   wp.back().router.add_route(StringRef::from_lit("/echo/"), 11);
   wp.back().router.add_route(StringRef::from_lit("/echo/foxtrot"), 12);
 
-  CU_ASSERT(10 == match_downstream_addr_group(
+  CU_ASSERT(11 == match_downstream_addr_group(
                       router, wp, StringRef::from_lit("git.nghttp2.org"),
                       StringRef::from_lit("/echo"), groups, 255));
 
@@ -200,9 +200,9 @@ void test_shrpx_worker_match_downstream_addr_group(void) {
                       router, wp, StringRef::from_lit("it.nghttp2.org"),
                       StringRef::from_lit("/echo"), groups, 255));
 
-  CU_ASSERT(12 == match_downstream_addr_group(
-                      router, wp, StringRef::from_lit(".nghttp2.org"),
-                      StringRef::from_lit("/echo/foxtrot"), groups, 255));
+  CU_ASSERT(255 == match_downstream_addr_group(
+                       router, wp, StringRef::from_lit(".nghttp2.org"),
+                       StringRef::from_lit("/echo/foxtrot"), groups, 255));
 
   CU_ASSERT(9 == match_downstream_addr_group(
                      router, wp, StringRef::from_lit("alpha.nghttp2.org"),