diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index ad08e05b3..88cb6bd8d 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -144,8 +144,8 @@ importers:
         specifier: ^1.18.2
         version: 1.18.2
       async:
-        specifier: ^3.2.5
-        version: 3.2.5
+        specifier: ^3.2.6
+        version: 3.2.6
       axios:
         specifier: ^1.7.4
         version: 1.7.4
@@ -2108,8 +2108,8 @@ packages:
     resolution: {integrity: sha512-x1FCFnFifvYDDzTaLII71vG5uvDwgtmDTEVWAxrgeiR8VjMONcCXJx7E+USjDtHlwFmt9MysbqgF9b9Vjr6w+w==}
     engines: {node: '>=4'}
 
-  async@3.2.5:
-    resolution: {integrity: sha512-baNZyqaaLhyLVKm/DlvdW051MSgO6b8eVfIezl9E5PqWxFgzLm/wQntEW4zOytVburDEr0JlALEpdOFwvErLsg==}
+  async@3.2.6:
+    resolution: {integrity: sha512-htCUDlxyyCLMgaM3xXg0C0LW2xqfuQ6p05pCEIsXuyQ+a1koYKTuBMzRNwmybfLgvJDMd0r1LTn4+E0Ti6C2AA==}
 
   asynckit@0.4.0:
     resolution: {integrity: sha512-Oei9OH4tRh0YqU3GxhX79dM/mwVgvbZJaSNaRk+bshkj0S5cfHcgYakreBjrHwatXKbz+IoIdYLxrKim2MjW0Q==}
@@ -6494,7 +6494,7 @@ snapshots:
     dependencies:
       tslib: 2.6.3
 
-  async@3.2.5: {}
+  async@3.2.6: {}
 
   asynckit@0.4.0: {}
 
@@ -7323,7 +7323,7 @@ snapshots:
 
   etherpad-cli-client@3.0.2:
     dependencies:
-      async: 3.2.5
+      async: 3.2.6
       socket.io-client: 4.7.5
       superagent: 8.1.2
     transitivePeerDependencies:
@@ -7957,7 +7957,7 @@ snapshots:
 
   jake@10.9.2:
     dependencies:
-      async: 3.2.5
+      async: 3.2.6
       chalk: 4.1.2
       filelist: 1.0.4
       minimatch: 3.1.2
diff --git a/src/package.json b/src/package.json
index 541c3bd2c..849cabcda 100644
--- a/src/package.json
+++ b/src/package.json
@@ -31,7 +31,7 @@
   ],
   "dependencies": {
     "@etherpad/express-session": "^1.18.2",
-    "async": "^3.2.5",
+    "async": "^3.2.6",
     "axios": "^1.7.4",
     "cookie-parser": "^1.4.6",
     "cross-env": "^7.0.3",