diff --git a/examples/passport-login/package.json b/examples/passport-login/package.json
index 3691d636c364..b785b909e533 100644
--- a/examples/passport-login/package.json
+++ b/examples/passport-login/package.json
@@ -68,7 +68,7 @@
     "@types/passport-local": "^1.0.38",
     "@types/passport-oauth2": "^1.8.0",
     "@types/passport-twitter": "1.0.40",
-    "body-parser": "^2.2.1",
+    "body-parser": "^2.2.2",
     "client-sessions": "^0.8.0",
     "debug": "^4.4.3",
     "express": "^4.22.1",
diff --git a/extensions/authentication-passport/package.json b/extensions/authentication-passport/package.json
index fc15bccb140d..5428e3c985eb 100644
--- a/extensions/authentication-passport/package.json
+++ b/extensions/authentication-passport/package.json
@@ -67,7 +67,7 @@
     "@types/passport-oauth2": "^1.8.0",
     "@types/qs": "^6.14.0",
     "axios": "^1.13.2",
-    "body-parser": "^2.2.1",
+    "body-parser": "^2.2.2",
     "express": "^4.22.1",
     "form-data": "^4.0.5",
     "jsonwebtoken": "^9.0.3",
diff --git a/extensions/graphql/package.json b/extensions/graphql/package.json
index 1c1f2b299960..2184bc673c34 100644
--- a/extensions/graphql/package.json
+++ b/extensions/graphql/package.json
@@ -47,7 +47,7 @@
     "@apollo/server": "^4.12.2",
     "@graphql-tools/utils": "^10.11.0",
     "@loopback/http-server": "^7.0.7",
-    "body-parser": "^2.2.1",
+    "body-parser": "^2.2.2",
     "cors": "^2.8.5",
     "debug": "^4.4.3",
     "express": "^4.22.1",
diff --git a/fixtures/mock-oauth2-provider/package.json b/fixtures/mock-oauth2-provider/package.json
index e224dfefea85..ba57017f14f1 100644
--- a/fixtures/mock-oauth2-provider/package.json
+++ b/fixtures/mock-oauth2-provider/package.json
@@ -41,7 +41,7 @@
     "@types/lodash": "^4.17.21",
     "@types/node": "^16.18.126",
     "axios": "^1.13.2",
-    "body-parser": "^2.2.1",
+    "body-parser": "^2.2.2",
     "express": "^4.22.1",
     "form-data": "^4.0.5",
     "jsonwebtoken": "^9.0.3",
diff --git a/package-lock.json b/package-lock.json
index ee8dc24d3e79..24703a3c6812 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -749,7 +749,7 @@
         "@types/passport-local": "^1.0.38",
         "@types/passport-oauth2": "^1.8.0",
         "@types/passport-twitter": "1.0.40",
-        "body-parser": "^2.2.1",
+        "body-parser": "^2.2.2",
         "client-sessions": "^0.8.0",
         "debug": "^4.4.3",
         "express": "^4.22.1",
@@ -1234,7 +1234,7 @@
         "@types/passport-oauth2": "^1.8.0",
         "@types/qs": "^6.14.0",
         "axios": "^1.13.2",
-        "body-parser": "^2.2.1",
+        "body-parser": "^2.2.2",
         "express": "^4.22.1",
         "form-data": "^4.0.5",
         "jsonwebtoken": "^9.0.3",
@@ -1345,7 +1345,7 @@
         "@apollo/server": "^4.12.2",
         "@graphql-tools/utils": "^10.11.0",
         "@loopback/http-server": "^7.0.7",
-        "body-parser": "^2.2.1",
+        "body-parser": "^2.2.2",
         "cors": "^2.8.5",
         "debug": "^4.4.3",
         "express": "^4.22.1",
@@ -1660,7 +1660,7 @@
         "@types/lodash": "^4.17.21",
         "@types/node": "^16.18.126",
         "axios": "^1.13.2",
-        "body-parser": "^2.2.1",
+        "body-parser": "^2.2.2",
         "express": "^4.22.1",
         "form-data": "^4.0.5",
         "jsonwebtoken": "^9.0.3",
@@ -12444,9 +12444,9 @@
       "integrity": "sha512-XpNj6GDQzdfW+r2Wnn7xiSAd7TM3jzkxGXBGTtWKuSXv1xUV+azxAm8jdWZN06QTQk+2N2XB9jRDkvbmQmcRtg=="
     },
     "node_modules/body-parser": {
-      "version": "2.2.1",
-      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-2.2.1.tgz",
-      "integrity": "sha512-nfDwkulwiZYQIGwxdy0RUmowMhKcFVcYXUU7m4QlKYim1rUtg83xm2yjZ40QjDuc291AJjjeSc9b++AWHSgSHw==",
+      "version": "2.2.2",
+      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-2.2.2.tgz",
+      "integrity": "sha512-oP5VkATKlNwcgvxi0vM0p/D3n2C3EReYVX+DNYs5TjZFn/oQt2j+4sVJtSMr18pdRr8wjTcBl6LoV+FUwzPmNA==",
       "license": "MIT",
       "dependencies": {
         "bytes": "^3.1.2",
@@ -12455,7 +12455,7 @@
         "http-errors": "^2.0.0",
         "iconv-lite": "^0.7.0",
         "on-finished": "^2.4.1",
-        "qs": "^6.14.0",
+        "qs": "^6.14.1",
         "raw-body": "^3.0.1",
         "type-is": "^2.0.1"
       },
@@ -12468,9 +12468,9 @@
       }
     },
     "node_modules/body-parser/node_modules/iconv-lite": {
-      "version": "0.7.0",
-      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.7.0.tgz",
-      "integrity": "sha512-cf6L2Ds3h57VVmkZe+Pn+5APsT7FpqJtEhhieDCvrE2MK5Qk9MyffgQyuxQTm6BChfeZNtcOLHp9IcWRVcIcBQ==",
+      "version": "0.7.1",
+      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.7.1.tgz",
+      "integrity": "sha512-2Tth85cXwGFHfvRgZWszZSvdo+0Xsqmw8k8ZwxScfcBneNUraK+dxRxRm24nszx80Y0TVio8kKLt5sLE7ZCLlw==",
       "license": "MIT",
       "dependencies": {
         "safer-buffer": ">= 2.1.2 < 3.0.0"
@@ -41367,7 +41367,7 @@
         "@types/express": "^4.17.25",
         "@types/express-serve-static-core": "^4.19.7",
         "@types/http-errors": "^2.0.5",
-        "body-parser": "^2.2.1",
+        "body-parser": "^2.2.2",
         "debug": "^4.4.3",
         "express": "^4.22.1",
         "http-errors": "^2.0.1",
@@ -41720,7 +41720,7 @@
         "ajv-errors": "^3.0.0",
         "ajv-formats": "^3.0.1",
         "ajv-keywords": "^5.1.0",
-        "body-parser": "^2.2.1",
+        "body-parser": "^2.2.2",
         "cors": "^2.8.5",
         "debug": "^4.4.3",
         "express": "^4.22.1",
diff --git a/packages/express/package.json b/packages/express/package.json
index 8cd546249d1b..10b30916d526 100644
--- a/packages/express/package.json
+++ b/packages/express/package.json
@@ -45,7 +45,7 @@
     "@types/express": "^4.17.25",
     "@types/express-serve-static-core": "^4.19.7",
     "@types/http-errors": "^2.0.5",
-    "body-parser": "^2.2.1",
+    "body-parser": "^2.2.2",
     "debug": "^4.4.3",
     "express": "^4.22.1",
     "http-errors": "^2.0.1",
diff --git a/packages/rest/package.json b/packages/rest/package.json
index 4c2fe5b31cd7..90516f8a72d8 100644
--- a/packages/rest/package.json
+++ b/packages/rest/package.json
@@ -54,7 +54,7 @@
     "ajv-errors": "^3.0.0",
     "ajv-formats": "^3.0.1",
     "ajv-keywords": "^5.1.0",
-    "body-parser": "^2.2.1",
+    "body-parser": "^2.2.2",
     "cors": "^2.8.5",
     "debug": "^4.4.3",
     "express": "^4.22.1",