diff --git a/apps/cli/package.json b/apps/cli/package.json
index fc38440b70f..a7a7bfd0c7b 100644
--- a/apps/cli/package.json
+++ b/apps/cli/package.json
@@ -75,7 +75,7 @@
     "inquirer": "8.2.6",
     "jsdom": "26.1.0",
     "jszip": "3.10.1",
-    "koa": "2.16.2",
+    "koa": "2.16.3",
     "koa-bodyparser": "4.4.1",
     "koa-json": "2.0.2",
     "lowdb": "1.0.0",
diff --git a/package-lock.json b/package-lock.json
index d6883a3405e..005eb38d80b 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -49,7 +49,7 @@
         "inquirer": "8.2.6",
         "jsdom": "26.1.0",
         "jszip": "3.10.1",
-        "koa": "2.16.2",
+        "koa": "2.16.3",
         "koa-bodyparser": "4.4.1",
         "koa-json": "2.0.2",
         "lit": "3.3.0",
@@ -213,7 +213,7 @@
         "inquirer": "8.2.6",
         "jsdom": "26.1.0",
         "jszip": "3.10.1",
-        "koa": "2.16.2",
+        "koa": "2.16.3",
         "koa-bodyparser": "4.4.1",
         "koa-json": "2.0.2",
         "lowdb": "1.0.0",
@@ -28074,9 +28074,9 @@
       }
     },
     "node_modules/koa": {
-      "version": "2.16.2",
-      "resolved": "https://registry.npmjs.org/koa/-/koa-2.16.2.tgz",
-      "integrity": "sha512-+CCssgnrWKx9aI3OeZwroa/ckG4JICxvIFnSiOUyl2Uv+UTI+xIw0FfFrWS7cQFpoePpr9o8csss7KzsTzNL8Q==",
+      "version": "2.16.3",
+      "resolved": "https://registry.npmjs.org/koa/-/koa-2.16.3.tgz",
+      "integrity": "sha512-zPPuIt+ku1iCpFBRwseMcPYQ1cJL8l60rSmKeOuGfOXyE6YnTBmf2aEFNL2HQGrD0cPcLO/t+v9RTgC+fwEh/g==",
       "license": "MIT",
       "dependencies": {
         "accepts": "^1.3.5",
diff --git a/package.json b/package.json
index 73ba1c05c91..7ca866b3c4d 100644
--- a/package.json
+++ b/package.json
@@ -186,7 +186,7 @@
     "inquirer": "8.2.6",
     "jsdom": "26.1.0",
     "jszip": "3.10.1",
-    "koa": "2.16.2",
+    "koa": "2.16.3",
     "koa-bodyparser": "4.4.1",
     "koa-json": "2.0.2",
     "lit": "3.3.0",