diff --git a/ci_cd/security_scans.sh b/ci_cd/security_scans.sh
index 17cf4c1817d..a0160316ced 100755
--- a/ci_cd/security_scans.sh
+++ b/ci_cd/security_scans.sh
@@ -129,6 +129,7 @@ run_grype_scans() {
         "CVE-2025-13836" # Python 3.13 HTTP response reading OOM/DoS - no fix available in base image
         "CVE-2025-12084" # Python 3.13 xml.dom.minidom quadratic algorithm - no fix available in base image
         "CVE-2025-60876" # BusyBox wget HTTP request splitting - no fix available in Chainguard Wolfi base image
+        "CVE-2026-22184" # zlib vulnerability - no fix available yet in Chainguard Wolfi base image
         "CVE-2010-4756" # glibc glob DoS - awaiting patched Wolfi glibc build
         "CVE-2019-1010022" # glibc stack guard bypass - awaiting patched Wolfi glibc build
         "CVE-2019-1010023" # glibc ldd remap issue - awaiting patched Wolfi glibc build
diff --git a/docker/Dockerfile.database b/docker/Dockerfile.database
index 49655129506..900d78d6e91 100644
--- a/docker/Dockerfile.database
+++ b/docker/Dockerfile.database
@@ -48,8 +48,9 @@ FROM $LITELLM_RUNTIME_IMAGE AS runtime
 # Ensure runtime stage runs as root
 USER root
 
-# Install runtime dependencies
-RUN apk add --no-cache bash openssl tzdata nodejs npm python3 py3-pip libsndfile
+# Install runtime dependencies and upgrade vulnerable packages
+RUN apk add --no-cache bash openssl tzdata nodejs npm python3 py3-pip libsndfile && \
+    apk upgrade --no-cache zlib busybox || true
 
 WORKDIR /app
 # Copy the current directory contents into the container at /app
diff --git a/package.json b/package.json
index 7f90fd0aeb9..90ba78b6fb7 100644
--- a/package.json
+++ b/package.json
@@ -11,6 +11,8 @@
     "jest": "^29.7.0"
   },
   "overrides": {
-    "glob": ">=11.1.0"
+    "glob": ">=11.1.0",
+    "tar": ">=7.5.2",
+    "diff": ">=8.0.3"
   }
 }
diff --git a/requirements.txt b/requirements.txt
index 7ec71fb7dc9..2981b0aeadc 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -47,6 +47,7 @@ sentry_sdk==2.21.0 # for sentry error handling
 detect-secrets==1.5.0 # Enterprise - secret detection / masking in LLM requests
 cryptography==44.0.1
 tzdata==2025.1 # IANA time zone database
+jaraco-context>=6.1.0 # security fix for GHSA-58pv-8j8x-9vj2
 litellm-proxy-extras==0.4.21 # for proxy extras - e.g. prisma migrations
 llm-sandbox==0.3.31 # for skill execution in sandbox
 ### LITELLM PACKAGE DEPENDENCIES
diff --git a/ui/litellm-dashboard/package.json b/ui/litellm-dashboard/package.json
index 58ac0ab0451..8fc186e52f9 100644
--- a/ui/litellm-dashboard/package.json
+++ b/ui/litellm-dashboard/package.json
@@ -85,7 +85,9 @@
     "mermaid": ">=11.10.0",
     "js-yaml": ">=4.1.1",
     "glob": ">=11.1.0",
-    "node-forge": ">=1.3.2"
+    "node-forge": ">=1.3.2",
+    "tar": ">=7.5.2",
+    "diff": ">=8.0.3"
   },
   "engines": {
     "node": ">=18.17.0",