diff --git a/doc/changelog.d/49.maintenance.md b/doc/changelog.d/49.maintenance.md
new file mode 100644
index 00000000..5a6b3c01
--- /dev/null
+++ b/doc/changelog.d/49.maintenance.md
@@ -0,0 +1 @@
+(draft) bump fast-uri to 4.1.3 per CVE-2026-76172
diff --git a/src/ansys/visor/dash/package.json b/src/ansys/visor/dash/package.json
index ea9fcc19..14de9d55 100644
--- a/src/ansys/visor/dash/package.json
+++ b/src/ansys/visor/dash/package.json
@@ -45,7 +45,7 @@
   },
   "overrides": {
     "minimatch": "10.2.3",
-    "fast-uri": "^3.1.5"
+    "fast-uri": "^4.1.3"
   },
   "engines": {
     "node": ">=8.11.0",