diff --git a/src/package-lock.json b/src/package-lock.json
index 935d8cd9d..a48d6dcd9 100644
--- a/src/package-lock.json
+++ b/src/package-lock.json
@@ -3113,6 +3113,20 @@
             "qs": "^6.10.3",
             "readable-stream": "^3.6.0",
             "semver": "^7.3.7"
+          },
+          "dependencies": {
+            "formidable": {
+              "version": "2.1.2",
+              "resolved": "https://registry.npmjs.org/formidable/-/formidable-2.1.2.tgz",
+              "integrity": "sha512-CM3GuJ57US06mlpQ47YcunuUZ9jpm8Vx+P2CGt2j7HpgkKZO/DJYQ0Bobim8G6PFQmK5lOqOOdUXboU+h73A4g==",
+              "dev": true,
+              "requires": {
+                "dezalgo": "^1.0.4",
+                "hexoid": "^1.0.0",
+                "once": "^1.4.0",
+                "qs": "^6.11.0"
+              }
+            }
           }
         }
       }
@@ -3438,14 +3452,13 @@
       }
     },
     "formidable": {
-      "version": "2.1.2",
-      "resolved": "https://registry.npmjs.org/formidable/-/formidable-2.1.2.tgz",
-      "integrity": "sha512-CM3GuJ57US06mlpQ47YcunuUZ9jpm8Vx+P2CGt2j7HpgkKZO/DJYQ0Bobim8G6PFQmK5lOqOOdUXboU+h73A4g==",
+      "version": "3.5.0",
+      "resolved": "https://registry.npmjs.org/formidable/-/formidable-3.5.0.tgz",
+      "integrity": "sha512-WwsMWvPmY+Kv37C3+KP3A+2Ym1aZoac4nz4ZEe5z0UPBoCg0O/wHay3eeYkZr4KJIbCzpSUeno+STMhde+KCfw==",
       "requires": {
         "dezalgo": "^1.0.4",
         "hexoid": "^1.0.0",
-        "once": "^1.4.0",
-        "qs": "^6.11.0"
+        "once": "^1.4.0"
       }
     },
     "forwarded": {
@@ -10109,6 +10122,17 @@
             "ms": "2.1.2"
           }
         },
+        "formidable": {
+          "version": "2.1.2",
+          "resolved": "https://registry.npmjs.org/formidable/-/formidable-2.1.2.tgz",
+          "integrity": "sha512-CM3GuJ57US06mlpQ47YcunuUZ9jpm8Vx+P2CGt2j7HpgkKZO/DJYQ0Bobim8G6PFQmK5lOqOOdUXboU+h73A4g==",
+          "requires": {
+            "dezalgo": "^1.0.4",
+            "hexoid": "^1.0.0",
+            "once": "^1.4.0",
+            "qs": "^6.11.0"
+          }
+        },
         "mime": {
           "version": "2.6.0",
           "resolved": "https://registry.npmjs.org/mime/-/mime-2.6.0.tgz",
diff --git a/src/package.json b/src/package.json
index 45f2a0fc1..c6579c783 100644
--- a/src/package.json
+++ b/src/package.json
@@ -43,7 +43,7 @@
     "express-session": "npm:@etherpad/express-session@^1.18.1",
     "fast-deep-equal": "^3.1.3",
     "find-root": "1.1.0",
-    "formidable": "^2.1.2",
+    "formidable": "^3.5.0",
     "http-errors": "^2.0.0",
     "js-cookie": "^3.0.5",
     "jsdom": "^20.0.0",