diff --git a/src/apps.js b/src/apps.js
index 24b932bd0..38c315a1c 100644
--- a/src/apps.js
+++ b/src/apps.js
@@ -628,7 +628,7 @@ function install(data, user, auditSource, callback) {
         if (icon) {
             if (!validator.isBase64(icon)) return callback(new AppsError(AppsError.BAD_FIELD, 'icon is not base64'));
 
-            if (!safe.fs.writeFileSync(path.join(paths.APP_ICONS_DIR, appId + '.png'), new Buffer(icon, 'base64'))) {
+            if (!safe.fs.writeFileSync(path.join(paths.APP_ICONS_DIR, appId + '.png'), Buffer.from(icon, 'base64'))) {
                 return callback(new AppsError(AppsError.INTERNAL_ERROR, 'Error saving icon:' + safe.error.message));
             }
         }
@@ -886,7 +886,7 @@ function update(appId, data, auditSource, callback) {
                 if (data.icon) {
                     if (!validator.isBase64(data.icon)) return callback(new AppsError(AppsError.BAD_FIELD, 'icon is not base64'));
 
-                    if (!safe.fs.writeFileSync(path.join(paths.APP_ICONS_DIR, appId + '.png'), new Buffer(data.icon, 'base64'))) {
+                    if (!safe.fs.writeFileSync(path.join(paths.APP_ICONS_DIR, appId + '.png'), Buffer.from(data.icon, 'base64'))) {
                         return callback(new AppsError(AppsError.INTERNAL_ERROR, 'Error saving icon:' + safe.error.message));
                     }
                 } else {
diff --git a/src/cert/acme2.js b/src/cert/acme2.js
index dcda16ec5..333003611 100644
--- a/src/cert/acme2.js
+++ b/src/cert/acme2.js
@@ -80,7 +80,7 @@ function urlBase64Encode(string) {
 }
 
 function b64(str) {
-    var buf = util.isBuffer(str) ? str : new Buffer(str);
+    var buf = util.isBuffer(str) ? str : Buffer.from(str);
     return urlBase64Encode(buf.toString('base64'));
 }
 
diff --git a/src/ldap.js b/src/ldap.js
index c25fd96cc..a7cc1912b 100644
--- a/src/ldap.js
+++ b/src/ldap.js
@@ -97,9 +97,9 @@ function finalSend(results, req, res, next) {
 
         var resultCookie;
         if (last < max) {
-            resultCookie = new Buffer(last.toString());
+            resultCookie = Buffer.from(last.toString());
         } else {
-            resultCookie = new Buffer('');
+            resultCookie = Buffer.from('');
         }
 
         res.controls.push(new ldap.PagedResultsControl({
diff --git a/src/users.js b/src/users.js
index 78cc351f0..10390ec1e 100644
--- a/src/users.js
+++ b/src/users.js
@@ -192,7 +192,7 @@ function create(username, password, email, displayName, options, auditSource, ca
                 username: username,
                 email: email,
                 fallbackEmail: email,   // for new users the fallbackEmail is also the default email
-                password: new Buffer(derivedKey, 'binary').toString('hex'),
+                password: Buffer.from(derivedKey, 'binary').toString('hex'),
                 salt: salt.toString('hex'),
                 createdAt: now,
                 modifiedAt: now,
@@ -249,11 +249,11 @@ function verify(userId, password, callback) {
             return callback(null, user);
         }
 
-        var saltBinary = new Buffer(user.salt, 'hex');
+        var saltBinary = Buffer.from(user.salt, 'hex');
         crypto.pbkdf2(password, saltBinary, CRYPTO_ITERATIONS, CRYPTO_KEY_LENGTH, CRYPTO_DIGEST, function (error, derivedKey) {
             if (error) return callback(new UsersError(UsersError.INTERNAL_ERROR, error));
 
-            var derivedKeyHex = new Buffer(derivedKey, 'binary').toString('hex');
+            var derivedKeyHex = Buffer.from(derivedKey, 'binary').toString('hex');
             if (derivedKeyHex !== user.password) return callback(new UsersError(UsersError.WRONG_PASSWORD));
 
             callback(null, user);
@@ -513,12 +513,12 @@ function setPassword(userId, newPassword, callback) {
 
         if (config.isDemo() && user.username === constants.DEMO_USERNAME) return callback(new UsersError(UsersError.BAD_FIELD, 'Not allowed in demo mode'));
 
-        var saltBuffer = new Buffer(user.salt, 'hex');
+        var saltBuffer = Buffer.from(user.salt, 'hex');
         crypto.pbkdf2(newPassword, saltBuffer, CRYPTO_ITERATIONS, CRYPTO_KEY_LENGTH, CRYPTO_DIGEST, function (error, derivedKey) {
             if (error) return callback(new UsersError(UsersError.INTERNAL_ERROR, error));
 
             user.modifiedAt = (new Date()).toISOString();
-            user.password = new Buffer(derivedKey, 'binary').toString('hex');
+            user.password = Buffer.from(derivedKey, 'binary').toString('hex');
             user.resetToken = '';
 
             userdb.update(userId, user, function (error) {