diff --git a/History.md b/History.md
index d4c013c103..a709b9c201 100644
--- a/History.md
+++ b/History.md
@@ -21,6 +21,7 @@ unreleased
     - Use `req.socket` over deprecated `req.connection`
     - deps: forwarded@0.2.0
     - deps: ipaddr.js@1.9.1
+  * deps: qs@6.9.6
   * deps: safe-buffer@5.2.1
   * deps: send@0.17.2
     - deps: http-errors@1.8.1
diff --git a/package.json b/package.json
index 791b76a455..7a5cb8b960 100644
--- a/package.json
+++ b/package.json
@@ -48,7 +48,7 @@
     "parseurl": "~1.3.3",
     "path-to-regexp": "0.1.7",
     "proxy-addr": "~2.0.7",
-    "qs": "6.7.0",
+    "qs": "6.9.6",
     "range-parser": "~1.2.1",
     "safe-buffer": "5.2.1",
     "send": "0.17.2",