diff --git a/package-lock.json b/package-lock.json
index 88297b6018d..7b968cf3a95 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -4380,7 +4380,7 @@
         "apollo-server-types": "file:packages/apollo-server-types",
         "graphql-subscriptions": "^1.0.0",
         "graphql-tools": "^4.0.0",
-        "koa": "2.7.0",
+        "koa": "2.8.1",
         "koa-bodyparser": "^3.0.0",
         "koa-router": "^7.4.0",
         "type-is": "^1.6.16"
@@ -5636,9 +5636,12 @@
       "dev": true
     },
     "content-disposition": {
-      "version": "0.5.2",
-      "resolved": "https://registry.npmjs.org/content-disposition/-/content-disposition-0.5.2.tgz",
-      "integrity": "sha1-DPaLud318r55YcOoUXjLhdunjLQ="
+      "version": "0.5.3",
+      "resolved": "https://registry.npmjs.org/content-disposition/-/content-disposition-0.5.3.tgz",
+      "integrity": "sha512-ExO0774ikEObIAEV9kDo50o+79VCUdEB6n6lzKgGwupcVeRlhrj3qGAfwq8G6uBJjkqLrhT0qEYFcWng8z1z0g==",
+      "requires": {
+        "safe-buffer": "5.1.2"
+      }
     },
     "content-type": {
       "version": "1.0.4",
@@ -8820,12 +8823,12 @@
       }
     },
     "http-assert": {
-      "version": "1.4.0",
-      "resolved": "https://registry.npmjs.org/http-assert/-/http-assert-1.4.0.tgz",
-      "integrity": "sha512-tPVv62a6l3BbQoM/N5qo969l0OFxqpnQzNUPeYfTP6Spo4zkgWeDBD1D5thI7sDLg7jCCihXTLB0X8UtdyAy8A==",
+      "version": "1.4.1",
+      "resolved": "https://registry.npmjs.org/http-assert/-/http-assert-1.4.1.tgz",
+      "integrity": "sha512-rdw7q6GTlibqVVbXr0CKelfV5iY8G2HqEUkhSk297BMbSpSL8crXC+9rjKoMcZZEsksX30le6f/4ul4E28gegw==",
       "requires": {
         "deep-equal": "~1.0.1",
-        "http-errors": "~1.7.1"
+        "http-errors": "~1.7.2"
       }
     },
     "http-cache-semantics": {
@@ -11957,9 +11960,9 @@
       "dev": true
     },
     "koa": {
-      "version": "2.7.0",
-      "resolved": "https://registry.npmjs.org/koa/-/koa-2.7.0.tgz",
-      "integrity": "sha512-7ojD05s2Q+hFudF8tDLZ1CpCdVZw8JQELWSkcfG9bdtoTDzMmkRF6BQBU7JzIzCCOY3xd3tftiy/loHBUYaY2Q==",
+      "version": "2.8.1",
+      "resolved": "https://registry.npmjs.org/koa/-/koa-2.8.1.tgz",
+      "integrity": "sha512-iCgjRkntcVud5amnioi+79r7TPVhKPfCY8UzL9GjyU+nIWTE9xsqyrJ6kib3InT9JYRyUu9Y67i5apCjf997TQ==",
       "requires": {
         "accepts": "^1.3.5",
         "cache-content-type": "^1.0.0",
@@ -13511,9 +13514,9 @@
       "dev": true
     },
     "parseurl": {
-      "version": "1.3.2",
-      "resolved": "https://registry.npmjs.org/parseurl/-/parseurl-1.3.2.tgz",
-      "integrity": "sha1-/CidTtiZMRlGDBViUyYs3I3mW/M="
+      "version": "1.3.3",
+      "resolved": "https://registry.npmjs.org/parseurl/-/parseurl-1.3.3.tgz",
+      "integrity": "sha512-CiyeOxFT/JZyN5m0z9PfXw4SCBJ6Sygz1Dpl0wqjlhDEGGBP1GnsUVEL0p63hoG1fcj3fHynXi9NYO4nWOL+qQ=="
     },
     "pascalcase": {
       "version": "0.1.1",
diff --git a/package.json b/package.json
index a718ef928b6..fb46356b029 100644
--- a/package.json
+++ b/package.json
@@ -117,7 +117,7 @@
     "jest-junit": "7.0.0",
     "jest-matcher-utils": "24.9.0",
     "js-sha256": "0.9.0",
-    "koa": "2.7.0",
+    "koa": "2.8.1",
     "lerna": "3.16.4",
     "memcached-mock": "0.1.0",
     "mock-req": "0.2.0",
diff --git a/packages/apollo-server-koa/package.json b/packages/apollo-server-koa/package.json
index 498e16a6e19..8317090267f 100644
--- a/packages/apollo-server-koa/package.json
+++ b/packages/apollo-server-koa/package.json
@@ -38,7 +38,7 @@
     "apollo-server-types": "file:../apollo-server-types",
     "graphql-subscriptions": "^1.0.0",
     "graphql-tools": "^4.0.0",
-    "koa": "2.7.0",
+    "koa": "2.8.1",
     "koa-bodyparser": "^3.0.0",
     "koa-router": "^7.4.0",
     "type-is": "^1.6.16"