diff --git a/apps/cli/package.json b/apps/cli/package.json
index 00686959ef0..fc38440b70f 100644
--- a/apps/cli/package.json
+++ b/apps/cli/package.json
@@ -75,7 +75,7 @@
     "inquirer": "8.2.6",
     "jsdom": "26.1.0",
     "jszip": "3.10.1",
-    "koa": "2.16.1",
+    "koa": "2.16.2",
     "koa-bodyparser": "4.4.1",
     "koa-json": "2.0.2",
     "lowdb": "1.0.0",
diff --git a/package-lock.json b/package-lock.json
index b017272cd77..dbb3fdb7e2d 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -49,7 +49,7 @@
         "inquirer": "8.2.6",
         "jsdom": "26.1.0",
         "jszip": "3.10.1",
-        "koa": "2.16.1",
+        "koa": "2.16.2",
         "koa-bodyparser": "4.4.1",
         "koa-json": "2.0.2",
         "lit": "3.3.0",
@@ -213,7 +213,7 @@
         "inquirer": "8.2.6",
         "jsdom": "26.1.0",
         "jszip": "3.10.1",
-        "koa": "2.16.1",
+        "koa": "2.16.2",
         "koa-bodyparser": "4.4.1",
         "koa-json": "2.0.2",
         "lowdb": "1.0.0",
@@ -27947,9 +27947,9 @@
       }
     },
     "node_modules/koa": {
-      "version": "2.16.1",
-      "resolved": "https://registry.npmjs.org/koa/-/koa-2.16.1.tgz",
-      "integrity": "sha512-umfX9d3iuSxTQP4pnzLOz0HKnPg0FaUUIKcye2lOiz3KPu1Y3M3xlz76dISdFPQs37P9eJz1wUpcTS6KDPn9fA==",
+      "version": "2.16.2",
+      "resolved": "https://registry.npmjs.org/koa/-/koa-2.16.2.tgz",
+      "integrity": "sha512-+CCssgnrWKx9aI3OeZwroa/ckG4JICxvIFnSiOUyl2Uv+UTI+xIw0FfFrWS7cQFpoePpr9o8csss7KzsTzNL8Q==",
       "license": "MIT",
       "dependencies": {
         "accepts": "^1.3.5",
diff --git a/package.json b/package.json
index 54e2685bbec..5d23d6b9938 100644
--- a/package.json
+++ b/package.json
@@ -186,7 +186,7 @@
     "inquirer": "8.2.6",
     "jsdom": "26.1.0",
     "jszip": "3.10.1",
-    "koa": "2.16.1",
+    "koa": "2.16.2",
     "koa-bodyparser": "4.4.1",
     "koa-json": "2.0.2",
     "lit": "3.3.0",