diff --git a/CHANGELOG.md b/CHANGELOG.md
index bed6564d..2ccdfeab 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,6 +9,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Security
 
+- **`fast-copy` 4.0.x → 4.1.2** (stack exhaustion on deeply nested values),
+  pulled in by the dev-only `pino-pretty` in the backend and `mcp-docs`. Not
+  shipped in production images.
+
 - **`@modelcontextprotocol/sdk` 1.30.0 → 1.31.0** in the backend (root
   lockfile) and the `mcp-docs` sidecar (GHSA-6qxp-vccf-f47h: the OAuth client
   could send credentials to an authorization server chosen by the MCP server).
diff --git a/mcp-docs/package-lock.json b/mcp-docs/package-lock.json
index 62bf8ef0..a0ddc04c 100644
--- a/mcp-docs/package-lock.json
+++ b/mcp-docs/package-lock.json
@@ -1928,9 +1928,9 @@
       }
     },
     "node_modules/fast-copy": {
-      "version": "4.0.2",
-      "resolved": "https://registry.npmjs.org/fast-copy/-/fast-copy-4.0.2.tgz",
-      "integrity": "sha512-ybA6PDXIXOXivLJK/z9e+Otk7ve13I4ckBvGO5I2RRmBU1gMHLVDJYEuJYhGwez7YNlYji2M2DvVU+a9mSFDlw==",
+      "version": "4.1.2",
+      "resolved": "https://registry.npmjs.org/fast-copy/-/fast-copy-4.1.2.tgz",
+      "integrity": "sha512-DUHggaYcouhy5I1LacDJ+JDSqGlumVJP2EAi5Nwt1pWPeLpSvIjkrY+x4fsoI1/+GlTyq+DM9zdgWCFSfqNODA==",
       "dev": true,
       "license": "MIT"
     },
diff --git a/package-lock.json b/package-lock.json
index 7525a8cc..5bd27703 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -12570,9 +12570,9 @@
       }
     },
     "node_modules/fast-copy": {
-      "version": "4.0.3",
-      "resolved": "https://registry.npmjs.org/fast-copy/-/fast-copy-4.0.3.tgz",
-      "integrity": "sha512-58apWr0GUiDFM8+3afrO6eYwJBn9ZAhDOzG3L+/9llab/haCARS2UIfffmOurYLwbgDRs8n0rfr6qAAPEAuAQw==",
+      "version": "4.1.2",
+      "resolved": "https://registry.npmjs.org/fast-copy/-/fast-copy-4.1.2.tgz",
+      "integrity": "sha512-DUHggaYcouhy5I1LacDJ+JDSqGlumVJP2EAi5Nwt1pWPeLpSvIjkrY+x4fsoI1/+GlTyq+DM9zdgWCFSfqNODA==",
       "dev": true,
       "license": "MIT"
     },