diff --git a/CHANGELOG.md b/CHANGELOG.md
index e217fd40a..4ff65456b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -67,6 +67,15 @@ All notable changes to this project will be documented in this file. See [standa
 * verdaccio update notification on CLI ([#988](https://github.com/verdaccio/verdaccio/issues/988)) ([#998](https://github.com/verdaccio/verdaccio/issues/998)) ([bc04703](https://github.com/verdaccio/verdaccio/commit/bc04703))
 
 
+<a name="3.11.4"></a>
+## [3.11.4](https://github.com/verdaccio/verdaccio/compare/v3.11.3...v3.11.4) (2019-02-11)
+
+
+### Bug Fixes
+
+* update dependencies due to security vulnerabilities ([f6f014a](https://github.com/verdaccio/verdaccio/commit/f6f014a))
+
+
 
 <a name="3.11.3"></a>
 ## [3.11.3](https://github.com/verdaccio/verdaccio/compare/v3.11.2...v3.11.3) (2019-02-07)
diff --git a/package.json b/package.json
index 3d7a56ac8..754765999 100644
--- a/package.json
+++ b/package.json
@@ -19,7 +19,7 @@
     "@verdaccio/local-storage": "2.0.0-beta.1",
     "@verdaccio/streams": "2.0.0-beta.0",
     "JSONStream": "1.3.4",
-    "async": "2.6.1",
+    "async": "3.0.1-0",
     "body-parser": "1.18.3",
     "bunyan": "1.8.12",
     "chalk": "2.4.1",
diff --git a/yarn.lock b/yarn.lock
index a74ad7e8b..5e464a94d 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -1795,6 +1795,11 @@ async@2.6.1, async@^2.1.4, async@^2.5.0:
   dependencies:
     lodash "^4.17.10"
 
+async@3.0.1-0:
+  version "3.0.1-0"
+  resolved "https://registry.verdaccio.org/async/-/async-3.0.1-0.tgz#ca06713f91c3d9eea3e966ace4093f41ef89f200"
+  integrity sha512-b+lONkCWH/GCAIrU0j4m5zed5t+5dfjM2TbUSmKCagx6TZp2jQrNkGL7j1SUb0fF1yH6sKBiXC7Zid8Zj94O6A==
+
 async@^1.5.2:
   version "1.5.2"
   resolved "https://registry.verdaccio.org/async/-/async-1.5.2.tgz#ec6a61ae56480c0c3cb241c95618e20892f9672a"