diff --git a/package-lock.json b/package-lock.json
index 9426d1779..b2962dea0 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -7295,9 +7295,9 @@
       }
     },
     "node_modules/@types/koa": {
-      "version": "2.13.6",
-      "resolved": "https://registry.npmjs.org/@types/koa/-/koa-2.13.6.tgz",
-      "integrity": "sha512-diYUfp/GqfWBAiwxHtYJ/FQYIXhlEhlyaU7lB/bWQrx4Il9lCET5UwpFy3StOAohfsxxvEQ11qIJgT1j2tfBvw==",
+      "version": "2.15.0",
+      "resolved": "https://registry.npmjs.org/@types/koa/-/koa-2.15.0.tgz",
+      "integrity": "sha512-7QFsywoE5URbuVnG3loe03QXuGajrnotr3gQkXcEBShORai23MePfFYdhz90FEtBBpkyIYQbVD+evKtloCgX3g==",
       "license": "MIT",
       "dependencies": {
         "@types/accepts": "*",
@@ -12215,9 +12215,9 @@
       "license": "MIT"
     },
     "node_modules/cookies": {
-      "version": "0.8.0",
-      "resolved": "https://registry.npmjs.org/cookies/-/cookies-0.8.0.tgz",
-      "integrity": "sha512-8aPsApQfebXnuI+537McwYsDtjVxGm8gTIzQI3FDW6t5t/DAhERxtnbEPN/8RX+uZthoz4eCOgloXaE5cYyNow==",
+      "version": "0.9.1",
+      "resolved": "https://registry.npmjs.org/cookies/-/cookies-0.9.1.tgz",
+      "integrity": "sha512-TG2hpqe4ELx54QER/S3HQ9SRVnQnGBtKUz5bLQWtYAQ+o6GpgMs6sYUvaiJjVxb+UXwhRhAEP3m7LbsIZ77Hmw==",
       "license": "MIT",
       "dependencies": {
         "depd": "~2.0.0",
@@ -19722,16 +19722,16 @@
       }
     },
     "node_modules/koa": {
-      "version": "2.14.2",
-      "resolved": "https://registry.npmjs.org/koa/-/koa-2.14.2.tgz",
-      "integrity": "sha512-VFI2bpJaodz6P7x2uyLiX6RLYpZmOJqNmoCst/Yyd7hQlszyPwG/I9CQJ63nOtKSxpt5M7NH67V6nJL2BwCl7g==",
+      "version": "2.16.0",
+      "resolved": "https://registry.npmjs.org/koa/-/koa-2.16.0.tgz",
+      "integrity": "sha512-Afhqq0Vq3W7C+/rW6IqHVBDLzqObwZ07JaUNUEF8yCQ6afiyFE3RAy+i7V0E46XOWlH7vPWn/x0vsZwNy6PWxw==",
       "license": "MIT",
       "dependencies": {
         "accepts": "^1.3.5",
         "cache-content-type": "^1.0.0",
         "content-disposition": "~0.5.2",
         "content-type": "^1.0.4",
-        "cookies": "~0.8.0",
+        "cookies": "~0.9.0",
         "debug": "^4.3.2",
         "delegates": "^1.0.0",
         "depd": "^2.0.0",
@@ -35812,7 +35812,7 @@
       "version": "0.7.5",
       "license": "MIT",
       "dependencies": {
-        "@types/koa": "^2.11.6",
+        "@types/koa": "^2.15.0",
         "@types/ws": "^7.4.0",
         "@web/parse5-utils": "^2.1.0",
         "chokidar": "^4.0.1",
@@ -35821,7 +35821,7 @@
         "get-stream": "^6.0.0",
         "is-stream": "^2.0.0",
         "isbinaryfile": "^5.0.0",
-        "koa": "^2.13.0",
+        "koa": "^2.16.0",
         "koa-etag": "^4.0.0",
         "koa-send": "^5.0.1",
         "koa-static": "^5.0.0",
@@ -36091,7 +36091,7 @@
     },
     "packages/dev-server-polyfill": {
       "name": "@web/dev-server-polyfill",
-      "version": "1.0.4",
+      "version": "1.0.6",
       "license": "MIT",
       "dependencies": {
         "@web/dev-server": "^0.4.0",
diff --git a/packages/dev-server-core/package.json b/packages/dev-server-core/package.json
index defcaf24f..d726b80eb 100644
--- a/packages/dev-server-core/package.json
+++ b/packages/dev-server-core/package.json
@@ -58,7 +58,7 @@
     "core"
   ],
   "dependencies": {
-    "@types/koa": "^2.11.6",
+    "@types/koa": "^2.15.0",
     "@types/ws": "^7.4.0",
     "@web/parse5-utils": "^2.1.0",
     "chokidar": "^4.0.1",
@@ -67,7 +67,7 @@
     "get-stream": "^6.0.0",
     "is-stream": "^2.0.0",
     "isbinaryfile": "^5.0.0",
-    "koa": "^2.13.0",
+    "koa": "^2.16.0",
     "koa-etag": "^4.0.0",
     "koa-send": "^5.0.1",
     "koa-static": "^5.0.0",