diff --git a/extensions/authentication-passport/package.json b/extensions/authentication-passport/package.json
index 52494e269d7d..09a14b030ac1 100644
--- a/extensions/authentication-passport/package.json
+++ b/extensions/authentication-passport/package.json
@@ -65,7 +65,7 @@
     "@types/passport": "^1.0.16",
     "@types/passport-http": "^0.3.11",
     "@types/passport-oauth2": "^1.4.17",
-    "@types/qs": "^6.9.15",
+    "@types/qs": "^6.9.16",
     "axios": "^1.7.2",
     "body-parser": "^1.20.3",
     "express": "^4.19.2",
@@ -74,7 +74,7 @@
     "lodash": "^4.17.21",
     "passport-http": "^0.3.0",
     "passport-oauth2": "^1.8.0",
-    "qs": "^6.12.3",
+    "qs": "^6.13.0",
     "supertest": "^7.0.0"
   }
 }
diff --git a/package-lock.json b/package-lock.json
index 51672dd9e36e..5da14f3e40dc 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -380,7 +380,7 @@
         "@loopback/rest": "^14.0.6",
         "@loopback/rest-explorer": "^7.0.6",
         "@loopback/service-proxy": "^7.0.6",
-        "express": "^4.20.0",
+        "express": "^4.19.2",
         "tslib": "^2.6.3"
       },
       "devDependencies": {
@@ -576,7 +576,7 @@
         "compression": "^1.7.4",
         "cors": "^2.8.5",
         "debug": "^4.3.7",
-        "express": "^4.20.0",
+        "express": "^4.19.2",
         "helmet": "^4.6.0",
         "loopback": "^3.28.0",
         "loopback-boot": "^3.3.1",
@@ -731,7 +731,7 @@
         "body-parser": "^1.20.3",
         "client-sessions": "^0.8.0",
         "debug": "^4.3.7",
-        "express": "^4.20.0",
+        "express": "^4.19.2",
         "express-session": "^1.18.0",
         "jade": "^1.11.0",
         "lodash": "^4.17.21",
@@ -848,7 +848,7 @@
       "license": "MIT",
       "dependencies": {
         "@loopback/core": "^6.1.3",
-        "express": "^4.20.0",
+        "express": "^4.19.2",
         "tslib": "^2.6.3"
       },
       "devDependencies": {
@@ -1227,16 +1227,16 @@
         "@types/passport": "^1.0.16",
         "@types/passport-http": "^0.3.11",
         "@types/passport-oauth2": "^1.4.17",
-        "@types/qs": "^6.9.15",
+        "@types/qs": "^6.9.16",
         "axios": "^1.7.2",
         "body-parser": "^1.20.3",
-        "express": "^4.20.0",
+        "express": "^4.19.2",
         "form-data": "^4.0.0",
         "jsonwebtoken": "^9.0.2",
         "lodash": "^4.17.21",
         "passport-http": "^0.3.0",
         "passport-oauth2": "^1.8.0",
-        "qs": "^6.12.3",
+        "qs": "^6.13.0",
         "supertest": "^7.0.0"
       },
       "engines": {
@@ -1344,7 +1344,7 @@
         "@loopback/http-server": "^6.0.6",
         "apollo-server-express": "^3.12.1",
         "debug": "^4.3.7",
-        "express": "^4.20.0",
+        "express": "^4.19.2",
         "graphql": "^15.9.0",
         "graphql-subscriptions": "^2.0.0",
         "type-graphql": "^1.1.1"
@@ -1458,7 +1458,7 @@
         "@loopback/testlab": "^7.0.6",
         "@types/express": "^4.17.21",
         "@types/node": "^16.18.101",
-        "express": "^4.20.0"
+        "express": "^4.19.2"
       },
       "engines": {
         "node": "18 || 20 || 22"
@@ -1625,7 +1625,7 @@
         "@types/node": "^16.18.101",
         "axios": "^1.7.2",
         "body-parser": "^1.20.3",
-        "express": "^4.20.0",
+        "express": "^4.19.2",
         "form-data": "^4.0.0",
         "jsonwebtoken": "^9.0.2",
         "lodash": "^4.17.21",
@@ -9325,9 +9325,10 @@
       }
     },
     "node_modules/@types/qs": {
-      "version": "6.9.15",
-      "resolved": "https://registry.npmjs.org/@types/qs/-/qs-6.9.15.tgz",
-      "integrity": "sha512-uXHQKES6DQKKCLh441Xv/dwxOq1TVS3JPUMlEqoEglvlhR6Mxnlew/Xq/LRVHpLyk7iK3zODe1qYHIMltO7XGg=="
+      "version": "6.9.16",
+      "resolved": "https://registry.npmjs.org/@types/qs/-/qs-6.9.16.tgz",
+      "integrity": "sha512-7i+zxXdPD0T4cKDuxCUXJ4wHcsJLwENa6Z3dCu8cfCK743OGy5Nu1RmAGqDPsoTDINVEcdXKRvR/zre+P2Ku1A==",
+      "license": "MIT"
     },
     "node_modules/@types/ramda": {
       "version": "0.29.4",
@@ -37322,7 +37323,7 @@
         "@types/http-errors": "^2.0.4",
         "body-parser": "^1.20.3",
         "debug": "^4.3.7",
-        "express": "^4.20.0",
+        "express": "^4.19.2",
         "http-errors": "^2.0.0",
         "on-finished": "^2.4.1",
         "toposort": "^2.0.2",
@@ -37688,14 +37689,14 @@
         "body-parser": "^1.20.3",
         "cors": "^2.8.5",
         "debug": "^4.3.7",
-        "express": "^4.20.0",
+        "express": "^4.19.2",
         "http-errors": "^2.0.0",
         "js-yaml": "^4.1.0",
         "json-schema-compare": "^0.2.2",
         "lodash": "^4.17.21",
         "on-finished": "^2.4.1",
         "path-to-regexp": "^6.2.2",
-        "qs": "^6.12.3",
+        "qs": "^6.13.0",
         "strong-error-handler": "^5.0.10",
         "tslib": "^2.6.3",
         "type-is": "^1.6.18",
@@ -37715,7 +37716,7 @@
         "@types/multer": "^1.4.12",
         "@types/node": "^16.18.101",
         "@types/on-finished": "^2.3.4",
-        "@types/qs": "^6.9.15",
+        "@types/qs": "^6.9.16",
         "multer": "^1.4.4"
       },
       "engines": {
@@ -37777,7 +37778,7 @@
         "@types/ejs": "^3.1.5",
         "@types/express": "^4.17.21",
         "@types/node": "^16.18.101",
-        "express": "^4.20.0"
+        "express": "^4.19.2"
       },
       "engines": {
         "node": "18 || 20 || 22"
@@ -37870,7 +37871,7 @@
         "@types/shot": "^4.0.5",
         "@types/sinon": "^17.0.3",
         "@types/supertest": "^2.0.16",
-        "express": "^4.20.0",
+        "express": "^4.19.2",
         "fs-extra": "^11.2.0",
         "oas-validator": "^5.0.8",
         "should": "^13.2.3",
diff --git a/packages/rest/package.json b/packages/rest/package.json
index 8d2bc9ba71bc..9682552774b3 100644
--- a/packages/rest/package.json
+++ b/packages/rest/package.json
@@ -64,7 +64,7 @@
     "lodash": "^4.17.21",
     "on-finished": "^2.4.1",
     "path-to-regexp": "^6.2.2",
-    "qs": "^6.12.3",
+    "qs": "^6.13.0",
     "strong-error-handler": "^5.0.10",
     "tslib": "^2.6.3",
     "type-is": "^1.6.18",
@@ -84,7 +84,7 @@
     "@types/multer": "^1.4.12",
     "@types/node": "^16.18.101",
     "@types/on-finished": "^2.3.4",
-    "@types/qs": "^6.9.15",
+    "@types/qs": "^6.9.16",
     "multer": "^1.4.4"
   }
 }