diff --git a/pyproject.toml b/pyproject.toml
index 71a63f9554..21bad56ec6 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -187,10 +187,11 @@ constraint-dependencies = [
     "aiohttp>=3.13.3", # Addresses CVE GHSA-6mq8-rvhq-8wgg
     "protobuf>=4.25.8", # Address CVE GHSA-8qvm-5x2c-j2w7
     "pyasn1>=0.6.2", # Address CVE GHSA-63vm-454h-vhhq
+    "python-multipart>=0.0.22", # Address CVE GHSA-wp53-j4wj-2cfg
     "ray[default,data]>=2.52", # Address CVE GHSA-q279-jhrf-cc6v
     "starlette>=0.49.1", # Address CVE GHSA-7f5h-v6xp-fcq8
-    "urllib3>=2.6.3", #Address CVE GHSA-38jv-5279-wg99
-    "wheel>=0.46.2", #Address CVE GHSA-8rrh-rw8j-w5fx
+    "urllib3>=2.6.3", # Address CVE GHSA-38jv-5279-wg99
+    "wheel>=0.46.2", # Address CVE GHSA-8rrh-rw8j-w5fx
     "xgrammar>=0.1.21", # Address CVE GHSA-5cmr-4px5-23pc
 ]
 override-dependencies = [
diff --git a/uv.lock b/uv.lock
index fb6c133df7..d42c84d944 100644
--- a/uv.lock
+++ b/uv.lock
@@ -36,6 +36,7 @@ constraints = [
     { name = "aiohttp", specifier = ">=3.13.3" },
     { name = "protobuf", specifier = ">=4.25.8" },
     { name = "pyasn1", specifier = ">=0.6.2" },
+    { name = "python-multipart", specifier = ">=0.0.22" },
     { name = "ray", extras = ["default", "data"], specifier = ">=2.52" },
     { name = "starlette", specifier = ">=0.49.1" },
     { name = "urllib3", specifier = ">=2.6.3" },
@@ -6288,11 +6289,11 @@ wheels = [
 
 [[package]]
 name = "python-multipart"
-version = "0.0.21"
+version = "0.0.22"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/78/96/804520d0850c7db98e5ccb70282e29208723f0964e88ffd9d0da2f52ea09/python_multipart-0.0.21.tar.gz", hash = "sha256:7137ebd4d3bbf70ea1622998f902b97a29434a9e8dc40eb203bbcf7c2a2cba92", size = 37196, upload-time = "2025-12-17T09:24:22.446Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/94/01/979e98d542a70714b0cb2b6728ed0b7c46792b695e3eaec3e20711271ca3/python_multipart-0.0.22.tar.gz", hash = "sha256:7340bef99a7e0032613f56dc36027b959fd3b30a787ed62d310e951f7c3a3a58", size = 37612, upload-time = "2026-01-25T10:15:56.219Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/aa/76/03af049af4dcee5d27442f71b6924f01f3efb5d2bd34f23fcd563f2cc5f5/python_multipart-0.0.21-py3-none-any.whl", hash = "sha256:cf7a6713e01c87aa35387f4774e812c4361150938d20d232800f75ffcf266090", size = 24541, upload-time = "2025-12-17T09:24:21.153Z" },
+    { url = "https://files.pythonhosted.org/packages/1b/d0/397f9626e711ff749a95d96b7af99b9c566a9bb5129b8e4c10fc4d100304/python_multipart-0.0.22-py3-none-any.whl", hash = "sha256:2b2cd894c83d21bf49d702499531c7bafd057d730c201782048f7945d82de155", size = 24579, upload-time = "2026-01-25T10:15:54.811Z" },
 ]
 
 [[package]]