diff --git a/packages/core/package.json b/packages/core/package.json
index 1035a419a1..92d177c69d 100644
--- a/packages/core/package.json
+++ b/packages/core/package.json
@@ -71,7 +71,7 @@
     "css-loader": "7.1.2",
     "deepmerge": "^4.3.1",
     "dotenv": "16.4.7",
-    "dotenv-expand": "11.0.7",
+    "dotenv-expand": "12.0.1",
     "html-rspack-plugin": "6.0.2",
     "http-proxy-middleware": "^2.0.6",
     "jiti": "^1.21.6",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index fd55310f8a..54cb5577f5 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -623,8 +623,8 @@ importers:
         specifier: 16.4.7
         version: 16.4.7
       dotenv-expand:
-        specifier: 11.0.7
-        version: 11.0.7
+        specifier: 12.0.1
+        version: 12.0.1
       html-rspack-plugin:
         specifier: 6.0.2
         version: 6.0.2(@rspack/core@1.1.5(@swc/helpers@0.5.15))
@@ -3739,6 +3739,10 @@ packages:
     resolution: {integrity: sha512-zIHwmZPRshsCdpMDyVsqGmgyP0yT8GAgXUnkdAoJisxvf33k7yO6OuoKmcTGuXPWSsm8Oh88nZicRLA9Y0rUeA==}
     engines: {node: '>=12'}
 
+  dotenv-expand@12.0.1:
+    resolution: {integrity: sha512-LaKRbou8gt0RNID/9RoI+J2rvXsBRPMV7p+ElHlPhcSARbCPDYcYG2s1TIzAfWv4YSgyY5taidWzzs31lNV3yQ==}
+    engines: {node: '>=12'}
+
   dotenv@16.4.7:
     resolution: {integrity: sha512-47qPchRCykZC03FhkYAhrvwU4xDBFIj1QPqaarj6mdM/hgUzfPHcpkHJOn3mJAufFeeAxAzeGsr5X0M4k6fLZQ==}
     engines: {node: '>=12'}
@@ -9458,6 +9462,10 @@ snapshots:
     dependencies:
       dotenv: 16.4.7
 
+  dotenv-expand@12.0.1:
+    dependencies:
+      dotenv: 16.4.7
+
   dotenv@16.4.7: {}
 
   duplexer@0.1.2: {}