diff --git a/.changeset/basic-ftp-6-2-1.md b/.changeset/basic-ftp-6-2-1.md
new file mode 100644
index 00000000..5ee5de0c
--- /dev/null
+++ b/.changeset/basic-ftp-6-2-1.md
@@ -0,0 +1,5 @@
+---
+'get-uri': patch
+---
+
+Update `basic-ftp` to v6.2.1 to address CVE-2026-102990 (GHSA-c475-qrg2-pj4r). As of `basic-ftp` v6, separate transfer hosts in PASV responses are no longer allowed by default.
diff --git a/packages/get-uri/package.json b/packages/get-uri/package.json
index 3aff47fa..f554f630 100644
--- a/packages/get-uri/package.json
+++ b/packages/get-uri/package.json
@@ -48,7 +48,7 @@
     "typescript": "catalog:"
   },
   "dependencies": {
-    "basic-ftp": "^5.3.1",
+    "basic-ftp": "^6.2.1",
     "data-uri-to-buffer": "workspace:*",
     "debug": "catalog:"
   },
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 0d4b4b2e..5d5e48c3 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -145,8 +145,8 @@ importers:
   packages/get-uri:
     dependencies:
       basic-ftp:
-        specifier: ^5.3.1
-        version: 5.3.1
+        specifier: ^6.2.1
+        version: 6.2.1
       data-uri-to-buffer:
         specifier: workspace:*
         version: link:../data-uri-to-buffer
@@ -1157,8 +1157,8 @@ packages:
   base64-js@1.5.1:
     resolution: {integrity: sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA==}
 
-  basic-ftp@5.3.1:
-    resolution: {integrity: sha512-bopVNp6ugyA150DDuZfPFdt1KZ5a94ZDiwX4hMgZDzF+GttD80lEy8kj98kbyhLXnPvhtIo93mdnLIjpCAeeOw==}
+  basic-ftp@6.2.1:
+    resolution: {integrity: sha512-bK67isD+lKq46AU8vNtjvMaT2ZqAOAmNCbxUHlFBRD4k15NWxyEjmaKtZPlgce58So4BNTjITGQOVTjL9y0ECA==}
     engines: {node: '>=10.0.0'}
 
   better-path-resolve@1.0.0:
@@ -2839,7 +2839,7 @@ snapshots:
 
   base64-js@1.5.1: {}
 
-  basic-ftp@5.3.1: {}
+  basic-ftp@6.2.1: {}
 
   better-path-resolve@1.0.0:
     dependencies: