diff --git a/package.json b/package.json
index d96a3d6f2..a611ff2dc 100644
--- a/package.json
+++ b/package.json
@@ -95,6 +95,7 @@
       "rollup": "4.30.1",
       "react-test-renderer": "19.2.3",
       "@xmldom/xmldom": ">=0.8.13",
+      "brace-expansion": "5.0.12",
       "flatted": ">=3.4.2",
       "immutable": ">=5.1.5",
       "minimatch": ">=3.1.4",
diff --git a/packages/jsActions/mobile-resources-native/CHANGELOG.md b/packages/jsActions/mobile-resources-native/CHANGELOG.md
index 81493aabc..634bb64a9 100644
--- a/packages/jsActions/mobile-resources-native/CHANGELOG.md
+++ b/packages/jsActions/mobile-resources-native/CHANGELOG.md
@@ -9,11 +9,12 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 ### Added
 
 -   We added mendix-native as a dependency to provide native file system.
+-   We bumped the `brace-expansion` package to v5.0.12 to fix a denial-of-service vulnerability.
 
 ## [12.5.1] Native Mobile Resources - 2026-10-8
 
-
 ## [2.3.0] Gallery
+
 ### Fixed
 
 -   We've fixed an issue where Gallery widget does not display data.
diff --git a/packages/jsActions/nanoflow-actions-native/CHANGELOG.md b/packages/jsActions/nanoflow-actions-native/CHANGELOG.md
index a1b2bb536..c87167bf4 100644
--- a/packages/jsActions/nanoflow-actions-native/CHANGELOG.md
+++ b/packages/jsActions/nanoflow-actions-native/CHANGELOG.md
@@ -9,6 +9,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 ### Added
 
 -   We added mendix-native as a dependency to provide native file system.
+-   We bumped the `brace-expansion` package to v5.0.12 to fix a denial-of-service vulnerability.
 
 ## [7.4.0] Nanoflow Commons - 2026-9-22
 
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 5068430d2..50f58dbd9 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -20,6 +20,7 @@ overrides:
   rollup: 4.30.1
   react-test-renderer: 19.2.3
   '@xmldom/xmldom': '>=0.8.13'
+  brace-expansion: 5.0.12
   flatted: '>=3.4.2'
   immutable: '>=5.1.5'
   minimatch: '>=3.1.4'
@@ -3385,8 +3386,8 @@ packages:
     resolution: {integrity: sha512-PyJxiNtA5T2PlLIeBot4lbp7rj4OadzjnMZD/G5zuBNt8ei/yCU7+wW0h2bag9vr8c+/WuRWmSxbqAl9hL1rBA==}
     engines: {node: '>= 5.10.0'}
 
-  brace-expansion@5.0.8:
-    resolution: {integrity: sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==}
+  brace-expansion@5.0.12:
+    resolution: {integrity: sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==}
     engines: {node: 20 || >=22}
 
   braces@3.0.3:
@@ -10849,7 +10850,7 @@ snapshots:
       big-integer: 1.6.52
     optional: true
 
-  brace-expansion@5.0.8:
+  brace-expansion@5.0.12:
     dependencies:
       balanced-match: 4.0.4
 
@@ -13715,7 +13716,7 @@ snapshots:
 
   minimatch@10.2.5:
     dependencies:
-      brace-expansion: 5.0.8
+      brace-expansion: 5.0.12
 
   minimist@1.2.8: {}