diff -u b/core/modules/system/src/MachineNameController.php b/core/modules/system/src/MachineNameController.php
--- b/core/modules/system/src/MachineNameController.php
+++ b/core/modules/system/src/MachineNameController.php
@@ -69,7 +69,7 @@
     if(isset($replace_pattern) && isset($replace)) {
       // Quote the pattern delimiter and remove null characters to avoid the e
       // or other modifiers being injected.
-      $transliterated = preg_replace('@' . strtr($replace_pattern, ['@' => '\@', chr(0) => ' ']) . '@', $replace, $transliterated);
+      $transliterated = preg_replace('@' . strtr($replace_pattern, ['@' => '\@', chr(0) => '']) . '@', $replace, $transliterated);
     }
     return new JsonResponse($transliterated);
   }
diff -u b/core/modules/system/tests/src/Unit/Transliteration/MachineNameControllerTest.php b/core/modules/system/tests/src/Unit/Transliteration/MachineNameControllerTest.php
--- b/core/modules/system/tests/src/Unit/Transliteration/MachineNameControllerTest.php
+++ b/core/modules/system/tests/src/Unit/Transliteration/MachineNameControllerTest.php
@@ -52,6 +52,8 @@
       array(array('text' => 'Äwesome', 'langcode' => 'de', 'lowercase' => TRUE), '"aewesome"'),
       array(array('text' => 'B?!"\/-ob', 'langcode' => 'en', 'lowercase' => TRUE, 'replace' => '_', 'replace_pattern' => '[^a-z0-9_.]+'), '"b_ob"'),
       array(array('text' => 'B?!"\/-ob@e', 'langcode' => 'en', 'lowercase' => TRUE, 'replace' => '_', 'replace_pattern' => '[^a-z0-9_.]+'), '"b_ob_e"'),
+      array(array('text' => 'a@e\0', 'langcode' => 'en', 'lowercase' => TRUE, 'replace' => '_', 'replace_pattern' => '[^a-z0-9_.]+'), '"a_e_0"'),
+      array(array('text' => 'a@e\0', 'langcode' => 'en', 'lowercase' => TRUE, 'replace' => '_', 'replace_pattern' => '[^a-z0-9_.@]+'), '"a@e_0"'),
     );
   }