diff --git a/package-lock.json b/package-lock.json
index 56295ed2..70eb776a 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -2002,9 +2002,9 @@
       "dev": true
     },
     "async": {
-      "version": "3.1.1",
-      "resolved": "https://registry.npmjs.org/async/-/async-3.1.1.tgz",
-      "integrity": "sha512-X5Dj8hK1pJNC2Wzo2Rcp9FBVdJMGRR/S7V+lH46s8GVFhtbo5O4Le5GECCF/8PISVdkUA6mMPvgz7qTTD1rf1g=="
+      "version": "3.2.2",
+      "resolved": "https://registry.npmjs.org/async/-/async-3.2.2.tgz",
+      "integrity": "sha512-H0E+qZaDEfx/FY4t7iLRv1W2fFI6+pyCeTw1uN20AQPiwqwM6ojPxHxdLv4z8hi2DtnW9BOckSspLucW7pIE5g=="
     },
     "async-each": {
       "version": "1.0.3",
diff --git a/package.json b/package.json
index c2cfd89a..4a297e8c 100644
--- a/package.json
+++ b/package.json
@@ -39,7 +39,7 @@
     "@hackmd/pandoc.js": "^0.1.9",
     "@passport-next/passport-openid": "~1.0.0",
     "archiver": "~3.1.1",
-    "async": "~3.1.0",
+    "async": "~3.2.2",
     "azure-storage": "~2.10.3",
     "babel-polyfill": "~6.26.0",
     "base64url": "~3.0.1",