diff --git a/apps/cli/package.json b/apps/cli/package.json
index c5aeb30623..a45e88acfa 100644
--- a/apps/cli/package.json
+++ b/apps/cli/package.json
@@ -57,7 +57,7 @@
   },
   "dependencies": {
     "@koa/multer": "3.0.2",
-    "@koa/router": "12.0.1",
+    "@koa/router": "13.1.0",
     "argon2": "0.40.1",
     "big-integer": "1.6.52",
     "browser-hrtime": "1.1.8",
diff --git a/package-lock.json b/package-lock.json
index 3a0b189e28..753d897557 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -27,7 +27,7 @@
         "@bitwarden/sdk-internal": "0.1.3",
         "@electron/fuses": "1.8.0",
         "@koa/multer": "3.0.2",
-        "@koa/router": "12.0.1",
+        "@koa/router": "13.1.0",
         "@microsoft/signalr": "8.0.7",
         "@microsoft/signalr-protocol-msgpack": "8.0.7",
         "@ng-select/ng-select": "11.2.0",
@@ -202,7 +202,7 @@
       "license": "SEE LICENSE IN LICENSE.txt",
       "dependencies": {
         "@koa/multer": "3.0.2",
-        "@koa/router": "12.0.1",
+        "@koa/router": "13.1.0",
         "argon2": "0.40.1",
         "big-integer": "1.6.52",
         "browser-hrtime": "1.1.8",
@@ -7021,20 +7021,17 @@
       }
     },
     "node_modules/@koa/router": {
-      "version": "12.0.1",
-      "resolved": "https://registry.npmjs.org/@koa/router/-/router-12.0.1.tgz",
-      "integrity": "sha512-ribfPYfHb+Uw3b27Eiw6NPqjhIhTpVFzEWLwyc/1Xp+DCdwRRyIlAUODX+9bPARF6aQtUu1+/PHzdNvRzcs/+Q==",
-      "deprecated": "Use v12.0.2 or higher to fix the vulnerability issue",
+      "version": "13.1.0",
+      "resolved": "https://registry.npmjs.org/@koa/router/-/router-13.1.0.tgz",
+      "integrity": "sha512-mNVu1nvkpSd8Q8gMebGbCkDWJ51ODetrFvLKYusej+V0ByD4btqHYnPIzTBLXnQMVUlm/oxVwqmWBY3zQfZilw==",
       "license": "MIT",
       "dependencies": {
-        "debug": "^4.3.4",
         "http-errors": "^2.0.0",
         "koa-compose": "^4.1.0",
-        "methods": "^1.1.2",
-        "path-to-regexp": "^6.2.1"
+        "path-to-regexp": "^6.3.0"
       },
       "engines": {
-        "node": ">= 12"
+        "node": ">= 18"
       }
     },
     "node_modules/@leichtgewicht/ip-codec": {
@@ -27277,6 +27274,7 @@
       "version": "1.1.2",
       "resolved": "https://registry.npmjs.org/methods/-/methods-1.1.2.tgz",
       "integrity": "sha512-iclAHeNqNm68zFtnZ0e+1L2yUIdvzNoauKU4WBA3VvH/vPFieF7qfRlwUZU+DA9P9bPXIS90ulxoUoCH23sV2w==",
+      "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">= 0.6"
diff --git a/package.json b/package.json
index 86224e7277..04b33e7709 100644
--- a/package.json
+++ b/package.json
@@ -161,7 +161,7 @@
     "@bitwarden/sdk-internal": "0.1.3",
     "@electron/fuses": "1.8.0",
     "@koa/multer": "3.0.2",
-    "@koa/router": "12.0.1",
+    "@koa/router": "13.1.0",
     "@microsoft/signalr": "8.0.7",
     "@microsoft/signalr-protocol-msgpack": "8.0.7",
     "@ng-select/ng-select": "11.2.0",