diff --git a/packages-legacy/koa-layer/package.json b/packages-legacy/koa-layer/package.json
index 345f337b8ed..b680e8f4d92 100644
--- a/packages-legacy/koa-layer/package.json
+++ b/packages-legacy/koa-layer/package.json
@@ -16,7 +16,7 @@
     "@midwayjs/serverless-fc-trigger": "^3.20.22",
     "@midwayjs/serverless-scf-starter": "^3.20.10",
     "@midwayjs/serverless-scf-trigger": "^3.20.22",
-    "koa": "2.16.2",
+    "koa": "2.16.4",
     "koa-bodyparser": "4.4.1",
     "koa-router": "12.0.1",
     "supertest": "6.3.3"
diff --git a/packages-legacy/static-layer/package.json b/packages-legacy/static-layer/package.json
index dfbabe82b74..68b498fd58a 100644
--- a/packages-legacy/static-layer/package.json
+++ b/packages-legacy/static-layer/package.json
@@ -14,7 +14,7 @@
     "@midwayjs/serverless-fc-trigger": "^3.20.22",
     "@midwayjs/serverless-scf-starter": "^3.20.10",
     "@midwayjs/serverless-scf-trigger": "^3.20.22",
-    "koa": "2.16.2",
+    "koa": "2.16.4",
     "koa-static-cache": "5.1.4",
     "path-to-regexp": "6.3.0",
     "request": "2.88.2",
diff --git a/packages/core/package.json b/packages/core/package.json
index 068af2250ea..7e2d37106ab 100644
--- a/packages/core/package.json
+++ b/packages/core/package.json
@@ -24,7 +24,7 @@
   "devDependencies": {
     "@midwayjs/logger": "^3.0.0",
     "eventsource": "2.0.2",
-    "koa": "2.16.2",
+    "koa": "2.16.4",
     "mm": "3.4.0",
     "raw-body": "2.5.2",
     "sinon": "17.0.2"
diff --git a/packages/web-koa/package.json b/packages/web-koa/package.json
index c93970f2c81..1cef2f6deab 100644
--- a/packages/web-koa/package.json
+++ b/packages/web-koa/package.json
@@ -36,7 +36,7 @@
     "@midwayjs/session": "^3.20.22",
     "@types/koa": "2.15.0",
     "@types/qs": "6.9.18",
-    "koa": "2.16.2",
+    "koa": "2.16.4",
     "koa-bodyparser": "4.4.1",
     "qs": "6.14.0"
   },