diff --git a/apps/meteor/package.json b/apps/meteor/package.json
index 65d6b071d8783..f2a405a675f9e 100644
--- a/apps/meteor/package.json
+++ b/apps/meteor/package.json
@@ -283,7 +283,7 @@
 		"react-stately": "~3.17.0",
 		"react-virtuoso": "~4.12.8",
 		"reflect-metadata": "^0.2.2",
-		"sanitize-html": "~2.16.0",
+		"sanitize-html": "~2.17.4",
 		"semver": "^7.6.3",
 		"sharp": "^0.33.5",
 		"sodium-native": "^4.3.3",
diff --git a/ee/packages/federation-matrix/package.json b/ee/packages/federation-matrix/package.json
index 8bfc8f954acbc..e28e6ec097f1c 100644
--- a/ee/packages/federation-matrix/package.json
+++ b/ee/packages/federation-matrix/package.json
@@ -35,7 +35,7 @@
 		"mongodb": "6.16.0",
 		"pino": "10.3.1",
 		"reflect-metadata": "^0.2.2",
-		"sanitize-html": "~2.17.3",
+		"sanitize-html": "~2.17.4",
 		"tsyringe": "^4.10.0",
 		"tweetnacl": "^1.0.3"
 	},
diff --git a/yarn.lock b/yarn.lock
index 2dae1c6f4c856..84f90a5d60726 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -9156,7 +9156,7 @@ __metadata:
     pino: "npm:10.3.1"
     pino-pretty: "npm:13.1.3"
     reflect-metadata: "npm:^0.2.2"
-    sanitize-html: "npm:~2.17.3"
+    sanitize-html: "npm:~2.17.4"
     tsyringe: "npm:^4.10.0"
     tweetnacl: "npm:^1.0.3"
     typescript: "npm:~5.9.3"
@@ -10072,7 +10072,7 @@ __metadata:
     react-stately: "npm:~3.17.0"
     react-virtuoso: "npm:~4.12.8"
     reflect-metadata: "npm:^0.2.2"
-    sanitize-html: "npm:~2.16.0"
+    sanitize-html: "npm:~2.17.4"
     semver: "npm:^7.6.3"
     sharp: "npm:^0.33.5"
     sinon: "npm:^19.0.5"
@@ -19753,6 +19753,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"dayjs@npm:^1.11.7":
+  version: 1.11.20
+  resolution: "dayjs@npm:1.11.20"
+  checksum: 10/5347533f21a55b8bb1b1ef559be9b805514c3a8fb7e68b75fb7e73808131c59e70909c073aa44ce8a0d159195cd110cdd4081cf87ab96cb06fee3edacae791c6
+  languageName: node
+  linkType: hard
+
 "dayjs@npm:^1.11.9":
   version: 1.11.13
   resolution: "dayjs@npm:1.11.13"
@@ -23845,7 +23852,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"htmlparser2@npm:^8.0.0, htmlparser2@npm:^8.0.2":
+"htmlparser2@npm:^8.0.2":
   version: 8.0.2
   resolution: "htmlparser2@npm:8.0.2"
   dependencies:
@@ -26806,6 +26813,15 @@ __metadata:
   languageName: node
   linkType: hard
 
+"launder@npm:^1.7.1":
+  version: 1.7.1
+  resolution: "launder@npm:1.7.1"
+  dependencies:
+    dayjs: "npm:^1.11.7"
+  checksum: 10/e0fbf7934728c9dd82eea3ccbebc31c021c9ffee225861cf6e2f219bdeb2be0d8585748eb700ec58a41a7dff5529e50ac84500657a7a927305685ec9f1cb3ab3
+  languageName: node
+  linkType: hard
+
 "layerr@npm:^0.1.2":
   version: 0.1.2
   resolution: "layerr@npm:0.1.2"
@@ -33356,31 +33372,18 @@ __metadata:
   languageName: node
   linkType: hard
 
-"sanitize-html@npm:~2.16.0":
-  version: 2.16.0
-  resolution: "sanitize-html@npm:2.16.0"
-  dependencies:
-    deepmerge: "npm:^4.2.2"
-    escape-string-regexp: "npm:^4.0.0"
-    htmlparser2: "npm:^8.0.0"
-    is-plain-object: "npm:^5.0.0"
-    parse-srcset: "npm:^1.0.2"
-    postcss: "npm:^8.3.11"
-  checksum: 10/eac99df964e3600717dec90867b4098ca66a75e8b0b2bb7ab1661090b35ebefd7776829d023905fbb55e58b2dd05a27dd3b99dde76d8bd75a973a26b4d77cd7a
-  languageName: node
-  linkType: hard
-
-"sanitize-html@npm:~2.17.3":
-  version: 2.17.3
-  resolution: "sanitize-html@npm:2.17.3"
+"sanitize-html@npm:~2.17.4":
+  version: 2.17.4
+  resolution: "sanitize-html@npm:2.17.4"
   dependencies:
     deepmerge: "npm:^4.2.2"
     escape-string-regexp: "npm:^4.0.0"
     htmlparser2: "npm:^10.1.0"
     is-plain-object: "npm:^5.0.0"
+    launder: "npm:^1.7.1"
     parse-srcset: "npm:^1.0.2"
     postcss: "npm:^8.3.11"
-  checksum: 10/adced2038708745c9cc2d079dd66f504c61ee232d30e205ee89e554bc5e6514626f8ffd01146abd637295d9910cf26e72511cf1e2937a448d722ee3ef6b813ce
+  checksum: 10/64db6f97fcbad57f4b0a97cc2eee85778580e38c4cafaa357e86ee0f796db0c497fda9c6d5d5f057edbdffee15551f208e174440f9c0d0f623e38534c975f7e0
   languageName: node
   linkType: hard