diff --git a/.changeset/six-toys-change.md b/.changeset/six-toys-change.md
new file mode 100644
index 0000000..9e76339
--- /dev/null
+++ b/.changeset/six-toys-change.md
@@ -0,0 +1,14 @@
+---
+"@neolution-ch/neolution.extensions.caching.distributed": patch
+"@neolution-ch/neolution.extensions.caching.redishybrid": patch
+"@neolution-ch/neolution.extensions.caching.abstractions": patch
+"@neolution-ch/neolution.extensions.caching.inmemory": patch
+---
+
+Bump MessagePack from 2.5.198 to 2.5.302
+
+| Package     | From    | To      | Bump     |
+| ----------- | ------- | ------- | -------- |
+| MessagePack | 2.5.198 | 2.5.302 | 🟢 patch |
+
+Security update. MessagePack 2.5.198 is affected by 11 advisories (2 high, 9 moderate), including GHSA-hv8m-jj95-wg3x (CVE-2026-48109, CVSS 8.2) and GHSA-vh6j-jc39-fggf (CVE-2026-48506, CVSS 7.5). Both `MessagePackDistributedCache` and `MsgPackSerializer` serialize with `MessagePackCompression.Lz4BlockArray` by default, which is the mode affected by the LZ4 out-of-bounds read advisory.
diff --git a/src/Neolution.Extensions.Caching.Distributed/Neolution.Extensions.Caching.Distributed.csproj b/src/Neolution.Extensions.Caching.Distributed/Neolution.Extensions.Caching.Distributed.csproj
index 446a296..8e412e4 100644
--- a/src/Neolution.Extensions.Caching.Distributed/Neolution.Extensions.Caching.Distributed.csproj
+++ b/src/Neolution.Extensions.Caching.Distributed/Neolution.Extensions.Caching.Distributed.csproj
@@ -7,7 +7,7 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="MessagePack" Version="2.5.198" />
+    <PackageReference Include="MessagePack" Version="2.5.302" />
     <PackageReference Include="Microsoft.Extensions.Caching.Abstractions" Version="6.0.0" />
     <PackageReference Include="Microsoft.Extensions.Options" Version="6.0.0" />
     <PackageReference Include="Neolution.CodeAnalysis" Version="2.6.1">
diff --git a/src/Neolution.Extensions.Caching.RedisHybrid/Neolution.Extensions.Caching.RedisHybrid.csproj b/src/Neolution.Extensions.Caching.RedisHybrid/Neolution.Extensions.Caching.RedisHybrid.csproj
index ecdd485..d0eca69 100644
--- a/src/Neolution.Extensions.Caching.RedisHybrid/Neolution.Extensions.Caching.RedisHybrid.csproj
+++ b/src/Neolution.Extensions.Caching.RedisHybrid/Neolution.Extensions.Caching.RedisHybrid.csproj
@@ -8,7 +8,7 @@
 
   <ItemGroup>
     <PackageReference Include="Foundatio.Redis" Version="10.6.0" />
-    <PackageReference Include="MessagePack" Version="2.5.198" />
+    <PackageReference Include="MessagePack" Version="2.5.302" />
     <PackageReference Include="Neolution.CodeAnalysis" Version="2.6.1">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>