diff --git a/HISTORY.md b/HISTORY.md
index 53849b6..2ecd55a 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,3 +1,8 @@
+unreleased
+==========
+
+  * Use `safe-buffer` for improved Buffer API
+
 0.5.2 / 2016-12-08
 ==================
 
diff --git a/index.js b/index.js
index 57d8ee4..2474d05 100644
--- a/index.js
+++ b/index.js
@@ -20,6 +20,7 @@ module.exports.parse = parse
  */
 
 var basename = require('path').basename
+var Buffer = require('safe-buffer').Buffer
 
 /**
  * RegExp to match non attr-char, *after* encodeURIComponent (i.e. not including "%")
@@ -280,7 +281,7 @@ function decodefield (str) {
       value = getlatin1(binary)
       break
     case 'utf-8':
-      value = new Buffer(binary, 'binary').toString('utf8')
+      value = Buffer.from(binary, 'binary').toString('utf8')
       break
     default:
       throw new TypeError('unsupported charset in extended field')
diff --git a/package.json b/package.json
index 32797ff..11cd22f 100644
--- a/package.json
+++ b/package.json
@@ -11,6 +11,9 @@
     "res"
   ],
   "repository": "jshttp/content-disposition",
+  "dependencies": {
+    "safe-buffer": "5.1.1"
+  },
   "devDependencies": {
     "eslint": "3.19.0",
     "eslint-config-standard": "7.0.0",