diff --git a/HISTORY.md b/HISTORY.md
index c623311f..6a649846 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,3 +1,8 @@
+Unreleased
+===================
+
+* deps: qs@~6.16.0
+
 1.20.6 / 2026-07-09
 ===================
 * Security fix for [GHSA-v422-hmwv-36x6](https://github.com/expressjs/body-parser/security/advisories/GHSA-v422-hmwv-36x6)
diff --git a/package.json b/package.json
index 211c7994..0213cd84 100644
--- a/package.json
+++ b/package.json
@@ -17,7 +17,7 @@
     "http-errors": "~2.0.1",
     "iconv-lite": "~0.4.24",
     "on-finished": "~2.4.1",
-    "qs": "~6.15.1",
+    "qs": "~6.16.0",
     "raw-body": "~2.5.3",
     "type-is": "~1.6.18",
     "unpipe": "~1.0.0"