diff --git a/CHANGELOG.md b/CHANGELOG.md
index 650545c9b9..ff764bf4a8 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -11,6 +11,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - Upgraded `@openrouter/ai-sdk-provider` from version `3.0.0` to `3.1.0`
 - Upgraded `ai` from version `7.0.37` to `7.0.114`
+- Upgraded `dotenv` from version `17.4.2` to `18.0.3`
 
 ## 3.77.0 - 2026-10-02
 
diff --git a/package-lock.json b/package-lock.json
index 276cbd3661..be96328456 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -71,7 +71,7 @@
         "countries-list": "3.4.1",
         "countup.js": "2.10.1",
         "date-fns": "4.4.0",
-        "dotenv": "17.4.2",
+        "dotenv": "18.0.3",
         "dotenv-expand": "13.0.0",
         "envalid": "8.2.0",
         "express": "5.2.1",
@@ -18032,6 +18032,19 @@
       "devOptional": true,
       "license": "MIT"
     },
+    "node_modules/c12/node_modules/dotenv": {
+      "version": "17.4.2",
+      "resolved": "https://registry.npmjs.org/dotenv/-/dotenv-17.4.2.tgz",
+      "integrity": "sha512-nI4U3TottKAcAD9LLud4Cb7b2QztQMUEfHbvhTH09bqXTxnSie8WnjPALV/WMCrJZ6UV/qHJ6L03OqO3LcdYZw==",
+      "devOptional": true,
+      "license": "BSD-2-Clause",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://dotenvx.com"
+      }
+    },
     "node_modules/c12/node_modules/jiti": {
       "version": "2.6.1",
       "resolved": "https://registry.npmjs.org/jiti/-/jiti-2.6.1.tgz",
@@ -20720,10 +20733,13 @@
       }
     },
     "node_modules/dotenv": {
-      "version": "17.4.2",
-      "resolved": "https://registry.npmjs.org/dotenv/-/dotenv-17.4.2.tgz",
-      "integrity": "sha512-nI4U3TottKAcAD9LLud4Cb7b2QztQMUEfHbvhTH09bqXTxnSie8WnjPALV/WMCrJZ6UV/qHJ6L03OqO3LcdYZw==",
+      "version": "18.0.3",
+      "resolved": "https://registry.npmjs.org/dotenv/-/dotenv-18.0.3.tgz",
+      "integrity": "sha512-/8CJTyL817qPnfbQrJgOEcrU3fDrJkRIoXBE566wHuvIXKOCHUZhPqGPbCPi9SogjdGnreF0TlvnTgK6J/8zpA==",
       "license": "BSD-2-Clause",
+      "bin": {
+        "dotenv": "dist/index.cjs"
+      },
       "engines": {
         "node": ">=12"
       },
@@ -20746,6 +20762,18 @@
         "url": "https://dotenvx.com"
       }
     },
+    "node_modules/dotenv-expand/node_modules/dotenv": {
+      "version": "17.4.2",
+      "resolved": "https://registry.npmjs.org/dotenv/-/dotenv-17.4.2.tgz",
+      "integrity": "sha512-nI4U3TottKAcAD9LLud4Cb7b2QztQMUEfHbvhTH09bqXTxnSie8WnjPALV/WMCrJZ6UV/qHJ6L03OqO3LcdYZw==",
+      "license": "BSD-2-Clause",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://dotenvx.com"
+      }
+    },
     "node_modules/dunder-proto": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/dunder-proto/-/dunder-proto-1.0.1.tgz",
diff --git a/package.json b/package.json
index 24db94c68d..7a32e9bdf5 100644
--- a/package.json
+++ b/package.json
@@ -115,7 +115,7 @@
     "countries-list": "3.4.1",
     "countup.js": "2.10.1",
     "date-fns": "4.4.0",
-    "dotenv": "17.4.2",
+    "dotenv": "18.0.3",
     "dotenv-expand": "13.0.0",
     "envalid": "8.2.0",
     "express": "5.2.1",