diff --git a/CHANGELOG.md b/CHANGELOG.md
index 432303eda..dbe16e201 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -15,6 +15,7 @@ and this project adheres to
 ### Fixed
 
 - 🔒️(backend) prevent editing client id and secret in Django admin
+- 🔒️(frontend) upgrade tiff to fix CVE-2026-4775
 
 ## [1.34.0] - 2026-10-07
 
diff --git a/docker/dinum-frontend/Dockerfile b/docker/dinum-frontend/Dockerfile
index 7a85018bc..7e43881ee 100644
--- a/docker/dinum-frontend/Dockerfile
+++ b/docker/dinum-frontend/Dockerfile
@@ -58,7 +58,7 @@ FROM nginxinc/nginx-unprivileged:1.30.4-alpine3.24 AS frontend-production
 
 USER root
 RUN apk upgrade --no-cache libexpat && \
-    apk add --no-cache --upgrade 'pcre2>=10.49-r0' && \
+    apk add --no-cache --upgrade 'pcre2>=10.49-r0' 'tiff>=4.7.2-r0' && \
     apk del curl
 USER nginx
 
diff --git a/src/frontend/Dockerfile b/src/frontend/Dockerfile
index c0918de35..0c01e2c3a 100644
--- a/src/frontend/Dockerfile
+++ b/src/frontend/Dockerfile
@@ -49,7 +49,7 @@ FROM nginxinc/nginx-unprivileged:1.30.4-alpine3.24 AS frontend-production
 
 USER root
 RUN apk upgrade --no-cache libexpat && \
-    apk add --no-cache --upgrade 'pcre2>=10.49-r0' && \
+    apk add --no-cache --upgrade 'pcre2>=10.49-r0' 'tiff>=4.7.2-r0' && \
     apk del curl
 USER nginx