diff --git a/extensions/authentication-passport/package.json b/extensions/authentication-passport/package.json
index 64785dad285b..81ba7e6084cd 100644
--- a/extensions/authentication-passport/package.json
+++ b/extensions/authentication-passport/package.json
@@ -69,7 +69,7 @@
     "axios": "^1.16.0",
     "body-parser": "^2.2.2",
     "express": "^4.22.2",
-    "form-data": "^4.0.5",
+    "form-data": "^4.0.6",
     "jsonwebtoken": "^9.0.3",
     "lodash": "^4.18.1",
     "passport-http": "^0.3.0",
diff --git a/fixtures/mock-oauth2-provider/package.json b/fixtures/mock-oauth2-provider/package.json
index 4e595e20387b..004e25e4902b 100644
--- a/fixtures/mock-oauth2-provider/package.json
+++ b/fixtures/mock-oauth2-provider/package.json
@@ -43,7 +43,7 @@
     "axios": "^1.16.0",
     "body-parser": "^2.2.2",
     "express": "^4.22.2",
-    "form-data": "^4.0.5",
+    "form-data": "^4.0.6",
     "jsonwebtoken": "^9.0.3",
     "lodash": "^4.18.1",
     "tslib": "^2.8.1"
diff --git a/package-lock.json b/package-lock.json
index c71b94dcfb49..0c7f94cc3146 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1562,7 +1562,7 @@
         "axios": "^1.16.0",
         "body-parser": "^2.2.2",
         "express": "^4.22.2",
-        "form-data": "^4.0.5",
+        "form-data": "^4.0.6",
         "jsonwebtoken": "^9.0.3",
         "lodash": "^4.18.1",
         "passport-http": "^0.3.0",
@@ -2047,7 +2047,7 @@
         "axios": "^1.16.0",
         "body-parser": "^2.2.2",
         "express": "^4.22.2",
-        "form-data": "^4.0.5",
+        "form-data": "^4.0.6",
         "jsonwebtoken": "^9.0.3",
         "lodash": "^4.18.1",
         "tslib": "^2.8.1"
@@ -16741,16 +16741,16 @@
       }
     },
     "node_modules/form-data": {
-      "version": "4.0.5",
-      "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.5.tgz",
-      "integrity": "sha512-8RipRLol37bNs2bhoV67fiTEvdTrbMUYcFTiy3+wuuOnUog2QBHCZWXDRijWQfAkhBj2Uf5UnVaiWwA5vdd82w==",
+      "version": "4.0.6",
+      "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.6.tgz",
+      "integrity": "sha512-vKatAh4SlVfgbv+YtmhiRjhEMJsYpsG1Y2rMQtR+SVSbytsSD1YGzDIcrAJmdFec88u/+VoGmxnl+80gL1tRCQ==",
       "license": "MIT",
       "dependencies": {
         "asynckit": "^0.4.0",
         "combined-stream": "^1.0.8",
         "es-set-tostringtag": "^2.1.0",
-        "hasown": "^2.0.2",
-        "mime-types": "^2.1.12"
+        "hasown": "^2.0.4",
+        "mime-types": "^2.1.35"
       },
       "engines": {
         "node": ">= 6"
@@ -18152,9 +18152,9 @@
       }
     },
     "node_modules/hasown": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.2.tgz",
-      "integrity": "sha512-0hJU9SCPvmMzIBdZFqNPXWa6dqh7WdH0cII9y+CyS8rG3nL48Bclra9HmKhVVUHyPWNH5Y7xDwAB7bfgSjkUMQ==",
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.4.tgz",
+      "integrity": "sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A==",
       "license": "MIT",
       "dependencies": {
         "function-bind": "^1.1.2"