diff --git a/package-lock.json b/package-lock.json
index ef94923..bac4b96 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -5690,9 +5690,9 @@
       "integrity": "sha1-5z3T17DXxe2G+6xrCufYxqadUPo="
     },
     "underscore": {
-      "version": "1.11.0",
-      "resolved": "https://registry.npmjs.org/underscore/-/underscore-1.11.0.tgz",
-      "integrity": "sha512-xY96SsN3NA461qIRKZ/+qox37YXPtSBswMGfiNptr+wrt6ds4HaMw23TP612fEyGekRE6LNRiLYr/aqbHXNedw=="
+      "version": "1.12.1",
+      "resolved": "https://registry.npmjs.org/underscore/-/underscore-1.12.1.tgz",
+      "integrity": "sha512-hEQt0+ZLDVUMhebKxL4x1BTtDY7bavVofhZ9KZ4aI26X9SRaE+Y3m83XUL1UP2jn8ynjndwCCpEHdUG+9pP1Tw=="
     },
     "undertaker": {
       "version": "1.3.0",
diff --git a/package.json b/package.json
index 74152bf..6f96913 100644
--- a/package.json
+++ b/package.json
@@ -34,7 +34,7 @@
     "socket.io": "^2.3.0",
     "stats.js": "^0.17.0",
     "three": "^0.84.0",
-    "underscore": "^1.11.0",
+    "underscore": "^1.12.1",
     "webpack": "^4.44.2",
     "webrtc-adapter": "^3.1.3",
     "webvr-polyfill": "^0.9.41"