diff --git a/debian/changelog b/debian/changelog
index cd84874..e12d92e 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,24 @@
+node-proxy-agents (0~2024040606-6+deb13u1) trixie; urgency=medium
+
+  * Team upload
+  * Fix basic-ftp traversal vulnerability (Closes: #1129093, CVE-2026-27699)
+
+ -- Yadd <yadd@debian.org>  Fri, 27 Feb 2026 07:58:26 +0100
+
+node-proxy-agents (0~2024040606-6) unstable; urgency=medium
+
+  * Team upload
+  * patch: fix compilation with nodejs 20.19.2
+
+ -- Jérémy Lal <kapouer@melix.org>  Tue, 20 May 2025 10:05:31 +0200
+
+node-proxy-agents (0~2024040606-5) unstable; urgency=medium
+
+  * Team upload
+  * node-get-uri Depends on node-basic-ftp. Closes: #1094198. 
+
+ -- Jérémy Lal <kapouer@melix.org>  Sat, 25 Jan 2025 23:57:35 +0100
+
 node-proxy-agents (0~2024040606-4) unstable; urgency=medium
 
   * Team upload
diff --git a/debian/control b/debian/control
index 8d550bb..8d2c2c3 100644
--- a/debian/control
+++ b/debian/control
@@ -85,6 +85,7 @@ Depends: ${misc:Depends}
  , node-data-uri-to-buffer (>= 5)
  , node-debug
  , node-fs-extra
+ , node-basic-ftp
 Multi-Arch: foreign
 Description: Node.js module that returns a stream.Readable from a URI string
  node-get-uri is a high-level module. It accepts a URI string and returns a
diff --git a/debian/patches/0005-get-uri-compilation.patch b/debian/patches/0005-get-uri-compilation.patch
new file mode 100644
index 0000000..848eb1d
--- /dev/null
+++ b/debian/patches/0005-get-uri-compilation.patch
@@ -0,0 +1,14 @@
+Description: our typescript cannot deal with OutgoingHttpHeaders, ignore errors
+Forwarded: not-needed
+Author: Jérémy Lal <kapouer@melix.org>
+Last-Update: 2025-05-20
+--- a/packages/get-uri/tsconfig.json
++++ b/packages/get-uri/tsconfig.json
+@@ -8,6 +8,7 @@
+     "outDir": "dist",
+     "sourceMap": true,
+     "declaration": true,
++    "noImplicitAny": false,
+     "typeRoots": [
+       "./@types",
+       "./node_modules/@types",
diff --git a/debian/patches/CVE-2026-27699.patch b/debian/patches/CVE-2026-27699.patch
new file mode 100644
index 0000000..9b7d881
--- /dev/null
+++ b/debian/patches/CVE-2026-27699.patch
@@ -0,0 +1,32 @@
+From: Patrick Juchli <patrickjuchli@gmail.com>
+Date: feb., 23 2026 09:01:12 +0100
+Subject: [PATCH] Skip invalid filenames
+Origin: upstream, https://github.com/patrickjuchli/basic-ftp/commit/2a2a0e65
+Bug: https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-5rq4-664w-9x2c
+Bug-Debian: https://bugs.debian.org/1129093
+Forwarded: not-needed
+Applied-Upstream: 5.2.0, commit:2a2a0e65
+Reviewed-By: Yadd <yadd@debian.org>
+
+--- a/basic-ftp/src/Client.ts
++++ b/basic-ftp/src/Client.ts
+@@ -1,5 +1,5 @@
+ import { createReadStream, createWriteStream, mkdir, readdir, stat, open, close, unlink } from "fs"
+-import { join } from "path"
++import { basename, join } from "path"
+ import { Readable, Writable } from "stream"
+ import { connect as connectTLS, ConnectionOptions as TLSConnectionOptions } from "tls"
+ import { promisify } from "util"
+@@ -694,6 +694,12 @@
+     protected async _downloadFromWorkingDir(localDirPath: string): Promise<void> {
+         await ensureLocalDirectory(localDirPath)
+         for (const file of await this.list()) {
++            const hasInvalidName = !file.name || basename(file.name) !== file.name
++            if (hasInvalidName) {
++                const safeName = JSON.stringify(file.name)
++                this.ftp.log(`Invalid filename from server listing, will skip file. (${safeName})`)
++                continue
++            }
+             const localPath = join(localDirPath, file.name)
+             if (file.isDirectory) {
+                 await this.cd(file.name)
diff --git a/debian/patches/series b/debian/patches/series
index 9679d38..11cd8b5 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -2,3 +2,5 @@
 use-quickjs-emscripten.patch
 tsc-workaround.patch
 0004-Use-modern-lru-cache.patch
+0005-get-uri-compilation.patch
+CVE-2026-27699.patch