diff --git a/packages/assets-controllers/CHANGELOG.md b/packages/assets-controllers/CHANGELOG.md
index df845b11905..d9e6c8ac2a3 100644
--- a/packages/assets-controllers/CHANGELOG.md
+++ b/packages/assets-controllers/CHANGELOG.md
@@ -12,6 +12,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Bump `uuid` from `^9.0.1` to `^11.1.1` ([#10243](https://github.com/MetaMask/core/pull/10243))
 - Bump `@metamask/transaction-controller` from `^70.0.1` to `^70.1.0` ([#10262](https://github.com/MetaMask/core/pull/10262))
 - Bump `@metamask/profile-sync-controller` from `^32.1.1` to `^32.2.0` ([#10348](https://github.com/MetaMask/core/pull/10348))
+- Bump `@types/bn.js` from `^5.1.5` to `^5.2.0` ([#10362](https://github.com/MetaMask/core/pull/10362))
+- Bump `bn.js` from `^5.2.1` to `^5.2.5` ([#10362](https://github.com/MetaMask/core/pull/10362))
 
 ## [112.0.2]
 
diff --git a/packages/assets-controllers/package.json b/packages/assets-controllers/package.json
index d8dfd646bb3..def0ebdbb46 100644
--- a/packages/assets-controllers/package.json
+++ b/packages/assets-controllers/package.json
@@ -86,10 +86,10 @@
     "@metamask/transaction-controller": "^70.1.0",
     "@metamask/utils": "^12.0.0",
     "@tanstack/query-core": "^5.62.16",
-    "@types/bn.js": "^5.1.5",
+    "@types/bn.js": "^5.2.0",
     "async-mutex": "^0.5.0",
     "bitcoin-address-validation": "^2.2.3",
-    "bn.js": "^5.2.1",
+    "bn.js": "^5.2.5",
     "immer": "^9.0.6",
     "lodash-es": "^4.17.21",
     "multiformats": "^9.9.0",
diff --git a/packages/controller-utils/CHANGELOG.md b/packages/controller-utils/CHANGELOG.md
index 0ff28a32a8c..c0ceb28a426 100644
--- a/packages/controller-utils/CHANGELOG.md
+++ b/packages/controller-utils/CHANGELOG.md
@@ -10,6 +10,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Changed
 
 - Bump `@metamask/utils` from `^11.12.0` to `^12.0.0` ([#10192](https://github.com/MetaMask/core/pull/10192))
+- Bump `@types/bn.js` from `^5.1.5` to `^5.2.0` ([#10362](https://github.com/MetaMask/core/pull/10362))
+- Bump `bn.js` from `^5.2.1` to `^5.2.5` ([#10362](https://github.com/MetaMask/core/pull/10362))
 
 ## [13.0.0]
 
diff --git a/packages/controller-utils/package.json b/packages/controller-utils/package.json
index e27cf8ab3b3..88d517fbfc5 100644
--- a/packages/controller-utils/package.json
+++ b/packages/controller-utils/package.json
@@ -53,9 +53,9 @@
     "@metamask/ethjs-unit": "^0.3.0",
     "@metamask/utils": "^12.0.0",
     "@signinwithethereum/siwe-parser": "^4.2.1",
-    "@types/bn.js": "^5.1.5",
+    "@types/bn.js": "^5.2.0",
     "bignumber.js": "^9.1.2",
-    "bn.js": "^5.2.1",
+    "bn.js": "^5.2.5",
     "cockatiel": "^3.1.2",
     "eth-ens-namehash": "^2.0.8",
     "fast-deep-equal": "^3.1.3",
diff --git a/packages/gas-fee-controller/CHANGELOG.md b/packages/gas-fee-controller/CHANGELOG.md
index f8b5e52b31e..9a40291bff9 100644
--- a/packages/gas-fee-controller/CHANGELOG.md
+++ b/packages/gas-fee-controller/CHANGELOG.md
@@ -12,6 +12,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Bump `@types/uuid` from `^8.3.0` to `^9.0.8` ([#10117](https://github.com/MetaMask/core/pull/10117))
 - Bump `uuid` from `^8.3.2` to `^11.1.1` ([#10117](https://github.com/MetaMask/core/pull/10117), [#10243](https://github.com/MetaMask/core/pull/10243))
 - Bump `@metamask/utils` from `^11.12.0` to `^12.0.0` ([#10192](https://github.com/MetaMask/core/pull/10192))
+- Bump `@types/bn.js` from `^5.1.5` to `^5.2.0` ([#10362](https://github.com/MetaMask/core/pull/10362))
+- Bump `bn.js` from `^5.2.1` to `^5.2.5` ([#10362](https://github.com/MetaMask/core/pull/10362))
 
 ## [27.0.0]
 
diff --git a/packages/gas-fee-controller/package.json b/packages/gas-fee-controller/package.json
index 34f64ca87e7..833b0850d60 100644
--- a/packages/gas-fee-controller/package.json
+++ b/packages/gas-fee-controller/package.json
@@ -58,8 +58,8 @@
     "@metamask/network-controller": "^37.0.0",
     "@metamask/polling-controller": "^17.0.0",
     "@metamask/utils": "^12.0.0",
-    "@types/bn.js": "^5.1.5",
-    "bn.js": "^5.2.1",
+    "@types/bn.js": "^5.2.0",
+    "bn.js": "^5.2.5",
     "uuid": "^11.1.1"
   },
   "devDependencies": {
diff --git a/packages/transaction-controller/CHANGELOG.md b/packages/transaction-controller/CHANGELOG.md
index 80e253fc0e3..37843baf0e5 100644
--- a/packages/transaction-controller/CHANGELOG.md
+++ b/packages/transaction-controller/CHANGELOG.md
@@ -17,6 +17,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   - The hooks default to non-sponsored and local signing when omitted. Sponsored transactions skip the `shouldSign` hook and local signing, while transactions that skip local signing retain an existing nonce and require a publish hook.
   - `isGasFeeSponsored` and `isExternalSign` remain in the public types as deprecated compatibility properties but no longer control the transaction lifecycle; `isGasFeeSponsored` remains available as migration metadata.
   - Add `TransactionMeta.isGasFeeSponsoredAvailable` and refresh it during approval preparation when simulation is enabled so sponsorship hooks receive current availability without overriding simulation preferences.
+- Bump `bn.js` from `^5.2.1` to `^5.2.5` ([#10362](https://github.com/MetaMask/core/pull/10362))
 
 ## [70.1.0]
 
diff --git a/packages/transaction-controller/package.json b/packages/transaction-controller/package.json
index 2d7ac3f8404..ea5c802b051 100644
--- a/packages/transaction-controller/package.json
+++ b/packages/transaction-controller/package.json
@@ -72,7 +72,7 @@
     "@metamask/utils": "^12.0.0",
     "async-mutex": "^0.5.0",
     "bignumber.js": "^9.1.2",
-    "bn.js": "^5.2.1",
+    "bn.js": "^5.2.5",
     "eth-method-registry": "^4.0.0",
     "ethereum-cryptography": "^2.1.2",
     "fast-json-patch": "^3.1.1",
@@ -86,7 +86,7 @@
     "@metamask/eth-block-tracker": "^16.0.0",
     "@metamask/eth-json-rpc-provider": "^7.0.0",
     "@metamask/ethjs-provider-http": "^0.3.0",
-    "@types/bn.js": "^5.1.5",
+    "@types/bn.js": "^5.2.0",
     "@types/jest": "^30.0.0",
     "@types/node": "^22.13.14",
     "@typescript/native": "npm:typescript@^7.0.2",
diff --git a/packages/transaction-pay-controller/CHANGELOG.md b/packages/transaction-pay-controller/CHANGELOG.md
index 6780d650759..e698e4a10f5 100644
--- a/packages/transaction-pay-controller/CHANGELOG.md
+++ b/packages/transaction-pay-controller/CHANGELOG.md
@@ -13,6 +13,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   - Honor the client's `atomic` hint: atomic max quotes use the source-token budget adjusted to destination decimals for 1:1 subsidized stablecoin routes, without a discovery quote or reusing the original deposit amount. Unsubsidized responses are re-quoted non-atomically.
   - Non-atomic hints start with `EXACT_INPUT` and upgrade to atomic execution when subsidized.
   - Atomic promotion errors retain the `Atomic promotion failed` prefix through standard quote error handling and strategy fallback.
+- Bump `bn.js` from `^5.2.1` to `^5.2.5` ([#10362](https://github.com/MetaMask/core/pull/10362))
 
 ## [29.0.2]
 
diff --git a/packages/transaction-pay-controller/package.json b/packages/transaction-pay-controller/package.json
index cc7e7076911..f089db13402 100644
--- a/packages/transaction-pay-controller/package.json
+++ b/packages/transaction-pay-controller/package.json
@@ -69,7 +69,7 @@
     "@metamask/transaction-controller": "^70.1.0",
     "@metamask/utils": "^12.0.0",
     "bignumber.js": "^9.1.2",
-    "bn.js": "^5.2.1",
+    "bn.js": "^5.2.5",
     "immer": "^9.0.6",
     "lodash-es": "^4.17.21"
   },
diff --git a/packages/user-operation-controller/CHANGELOG.md b/packages/user-operation-controller/CHANGELOG.md
index 67e6a9e6c8f..6d491f8757d 100644
--- a/packages/user-operation-controller/CHANGELOG.md
+++ b/packages/user-operation-controller/CHANGELOG.md
@@ -12,6 +12,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Bump `uuid` from `^8.3.2` to `^11.1.1` ([#10117](https://github.com/MetaMask/core/pull/10117), [#10243](https://github.com/MetaMask/core/pull/10243))
 - Bump `@metamask/utils` from `^11.12.0` to `^12.0.0` ([#10192](https://github.com/MetaMask/core/pull/10192))
 - Bump `@metamask/transaction-controller` from `^70.0.0` to `^70.1.0` ([#10242](https://github.com/MetaMask/core/pull/10242), [#10262](https://github.com/MetaMask/core/pull/10262))
+- Bump `bn.js` from `^5.2.1` to `^5.2.5` ([#10362](https://github.com/MetaMask/core/pull/10362))
 
 ## [42.0.0]
 
diff --git a/packages/user-operation-controller/package.json b/packages/user-operation-controller/package.json
index d2b5684818d..3aabb8ebc02 100644
--- a/packages/user-operation-controller/package.json
+++ b/packages/user-operation-controller/package.json
@@ -64,7 +64,7 @@
     "@metamask/superstruct": "^3.4.1",
     "@metamask/transaction-controller": "^70.1.0",
     "@metamask/utils": "^12.0.0",
-    "bn.js": "^5.2.1",
+    "bn.js": "^5.2.5",
     "immer": "^9.0.6",
     "lodash-es": "^4.17.21",
     "uuid": "^11.1.1"
diff --git a/yarn.lock b/yarn.lock
index 485322abfad..c1042ae4e13 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -5936,14 +5936,14 @@ __metadata:
     "@metamask/transaction-controller": "npm:^70.1.0"
     "@metamask/utils": "npm:^12.0.0"
     "@tanstack/query-core": "npm:^5.62.16"
-    "@types/bn.js": "npm:^5.1.5"
+    "@types/bn.js": "npm:^5.2.0"
     "@types/jest": "npm:^30.0.0"
     "@types/lodash-es": "npm:^4.17.12"
     "@types/node": "npm:^22.13.14"
     "@typescript/native": "npm:typescript@^7.0.2"
     async-mutex: "npm:^0.5.0"
     bitcoin-address-validation: "npm:^2.2.3"
-    bn.js: "npm:^5.2.1"
+    bn.js: "npm:^5.2.5"
     deepmerge: "npm:^4.2.2"
     immer: "npm:^9.0.6"
     jest: "npm:^30.4.2"
@@ -6526,12 +6526,12 @@ __metadata:
     "@metamask/ethjs-unit": "npm:^0.3.0"
     "@metamask/utils": "npm:^12.0.0"
     "@signinwithethereum/siwe-parser": "npm:^4.2.1"
-    "@types/bn.js": "npm:^5.1.5"
+    "@types/bn.js": "npm:^5.2.0"
     "@types/jest": "npm:^30.0.0"
     "@types/lodash-es": "npm:^4.17.12"
     "@typescript/native": "npm:typescript@^7.0.2"
     bignumber.js: "npm:^9.1.2"
-    bn.js: "npm:^5.2.1"
+    bn.js: "npm:^5.2.5"
     cockatiel: "npm:^3.1.2"
     deepmerge: "npm:^4.2.2"
     eth-ens-namehash: "npm:^2.0.8"
@@ -7320,11 +7320,11 @@ __metadata:
     "@metamask/network-controller": "npm:^37.0.0"
     "@metamask/polling-controller": "npm:^17.0.0"
     "@metamask/utils": "npm:^12.0.0"
-    "@types/bn.js": "npm:^5.1.5"
+    "@types/bn.js": "npm:^5.2.0"
     "@types/jest": "npm:^30.0.0"
     "@types/jest-when": "npm:^3.5.3"
     "@typescript/native": "npm:typescript@^7.0.2"
-    bn.js: "npm:^5.2.1"
+    bn.js: "npm:^5.2.5"
     deepmerge: "npm:^4.2.2"
     jest: "npm:^30.4.2"
     jest-when: "npm:^3.7.0"
@@ -9419,13 +9419,13 @@ __metadata:
     "@metamask/remote-feature-flag-controller": "npm:^7.0.0"
     "@metamask/rpc-errors": "npm:^7.0.2"
     "@metamask/utils": "npm:^12.0.0"
-    "@types/bn.js": "npm:^5.1.5"
+    "@types/bn.js": "npm:^5.2.0"
     "@types/jest": "npm:^30.0.0"
     "@types/node": "npm:^22.13.14"
     "@typescript/native": "npm:typescript@^7.0.2"
     async-mutex: "npm:^0.5.0"
     bignumber.js: "npm:^9.1.2"
-    bn.js: "npm:^5.2.1"
+    bn.js: "npm:^5.2.5"
     deepmerge: "npm:^4.2.2"
     eth-method-registry: "npm:^4.0.0"
     ethereum-cryptography: "npm:^2.1.2"
@@ -9473,7 +9473,7 @@ __metadata:
     "@types/jest": "npm:^30.0.0"
     "@typescript/native": "npm:typescript@^7.0.2"
     bignumber.js: "npm:^9.1.2"
-    bn.js: "npm:^5.2.1"
+    bn.js: "npm:^5.2.5"
     deepmerge: "npm:^4.2.2"
     immer: "npm:^9.0.6"
     jest: "npm:^30.4.2"
@@ -9508,7 +9508,7 @@ __metadata:
     "@metamask/utils": "npm:^12.0.0"
     "@types/jest": "npm:^30.0.0"
     "@typescript/native": "npm:typescript@^7.0.2"
-    bn.js: "npm:^5.2.1"
+    bn.js: "npm:^5.2.5"
     deepmerge: "npm:^4.2.2"
     immer: "npm:^9.0.6"
     jest: "npm:^30.4.2"
@@ -11778,12 +11778,12 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@types/bn.js@npm:*, @types/bn.js@npm:^5.1.0, @types/bn.js@npm:^5.1.5":
-  version: 5.1.6
-  resolution: "@types/bn.js@npm:5.1.6"
+"@types/bn.js@npm:*, @types/bn.js@npm:^5.1.0, @types/bn.js@npm:^5.1.5, @types/bn.js@npm:^5.2.0":
+  version: 5.2.0
+  resolution: "@types/bn.js@npm:5.2.0"
   dependencies:
     "@types/node": "npm:*"
-  checksum: 10/db565b5a2af59b09459d74441153bf23a0e80f1fb2d070330786054e7ce1a7285dc40afcd8f289426c61a83166bdd70814f70e2d439744686aac5d3ea75daf13
+  checksum: 10/06c93841f74e4a5e5b81b74427d56303b223c9af36389b4cd3c562bda93f43c425c7e241aee1b0b881dde57238dc2e07f21d30d412b206a7dae4435af4c054e8
   languageName: node
   linkType: hard
 
@@ -14667,10 +14667,10 @@ __metadata:
   languageName: node
   linkType: hard
 
-"bn.js@npm:^5.1.2, bn.js@npm:^5.2.0, bn.js@npm:^5.2.1, bn.js@npm:^5.2.2":
-  version: 5.2.2
-  resolution: "bn.js@npm:5.2.2"
-  checksum: 10/51ebb2df83b33e5d8581165206e260d5e9c873752954616e5bf3758952b84d7399a9c6d00852815a0aeefb1150a7f34451b62d4287342d457fa432eee869e83e
+"bn.js@npm:^5.1.2, bn.js@npm:^5.2.0, bn.js@npm:^5.2.1, bn.js@npm:^5.2.2, bn.js@npm:^5.2.5":
+  version: 5.2.5
+  resolution: "bn.js@npm:5.2.5"
+  checksum: 10/10b1ac91e76fd828c1187cf65a9f1a0374e7afb9acd167e19c2d7c4108f6216841007c1e3aef145fa95cc7b3d07f705236a707184af1537667362b3a842d01ac
   languageName: node
   linkType: hard