diff --git a/api/package.json b/api/package.json
index fcd353af575a..4a18700615c1 100644
--- a/api/package.json
+++ b/api/package.json
@@ -68,7 +68,7 @@
     "express-static-gzip": "^2.2.0",
     "file-type": "^18.7.0",
     "firebase": "^11.0.2",
-    "form-data": "^4.0.4",
+    "form-data": "^4.0.6",
     "handlebars": "^4.7.7",
     "https-proxy-agent": "^7.0.6",
     "ioredis": "^5.3.2",
diff --git a/package-lock.json b/package-lock.json
index 09c5219afbbb..af2afff9212b 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -83,7 +83,7 @@
         "express-static-gzip": "^2.2.0",
         "file-type": "^18.7.0",
         "firebase": "^11.0.2",
-        "form-data": "^4.0.4",
+        "form-data": "^4.0.6",
         "handlebars": "^4.7.7",
         "https-proxy-agent": "^7.0.6",
         "ioredis": "^5.3.2",
@@ -27796,21 +27796,33 @@
       }
     },
     "node_modules/form-data": {
-      "version": "4.0.5",
-      "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.5.tgz",
-      "integrity": "sha512-8RipRLol37bNs2bhoV67fiTEvdTrbMUYcFTiy3+wuuOnUog2QBHCZWXDRijWQfAkhBj2Uf5UnVaiWwA5vdd82w==",
+      "version": "4.0.6",
+      "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.6.tgz",
+      "integrity": "sha512-vKatAh4SlVfgbv+YtmhiRjhEMJsYpsG1Y2rMQtR+SVSbytsSD1YGzDIcrAJmdFec88u/+VoGmxnl+80gL1tRCQ==",
       "license": "MIT",
       "dependencies": {
         "asynckit": "^0.4.0",
         "combined-stream": "^1.0.8",
         "es-set-tostringtag": "^2.1.0",
-        "hasown": "^2.0.2",
-        "mime-types": "^2.1.12"
+        "hasown": "^2.0.4",
+        "mime-types": "^2.1.35"
       },
       "engines": {
         "node": ">= 6"
       }
     },
+    "node_modules/form-data/node_modules/hasown": {
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.4.tgz",
+      "integrity": "sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A==",
+      "license": "MIT",
+      "dependencies": {
+        "function-bind": "^1.1.2"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
     "node_modules/format": {
       "version": "0.2.2",
       "resolved": "https://registry.npmjs.org/format/-/format-0.2.2.tgz",
@@ -44206,7 +44218,7 @@
         "express": "^5.1.0",
         "express-session": "^1.18.2",
         "firebase": "^11.0.2",
-        "form-data": "^4.0.4",
+        "form-data": "^4.0.6",
         "google-auth-library": "^9.15.1",
         "https-proxy-agent": "^7.0.6",
         "ioredis": "^5.3.2",
diff --git a/packages/api/package.json b/packages/api/package.json
index e4ca4ef3c548..ecfce2152c57 100644
--- a/packages/api/package.json
+++ b/packages/api/package.json
@@ -100,7 +100,7 @@
     "express": "^5.1.0",
     "express-session": "^1.18.2",
     "firebase": "^11.0.2",
-    "form-data": "^4.0.4",
+    "form-data": "^4.0.6",
     "google-auth-library": "^9.15.1",
     "https-proxy-agent": "^7.0.6",
     "ioredis": "^5.3.2",