diff --git a/CHANGELOG.md b/CHANGELOG.md
index a9b25a9..e1bbca3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,6 +3,7 @@
 ## [Unreleased]
 
 ### Bugs Fixed
+- Update `@grpc/grpc-js` from 1.14.4 to 1.14.5 in the root and AKS LangChain sample lockfiles to address [CVE-2026-101915](https://github.com/advisories/GHSA-f596-whhp-79r4) and [CVE-2026-101916](https://github.com/advisories/GHSA-m9gg-hp2v-232j).
 - A365: centralize shared request attributes in the base scope, including session and conversation IDs, channel details, and `operationSource` as `service.name`, while retaining last-write-wins `recordAttributes()` behavior. [#243](https://github.com/microsoft/opentelemetry-distro-javascript/pull/243)
 - Default `InvokeAgentScope` spans to `SpanKind.INTERNAL` while preserving explicit span-kind overrides. [#241](https://github.com/microsoft/opentelemetry-distro-javascript/pull/241)
 
diff --git a/package-lock.json b/package-lock.json
index 393f7bf..042f311 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -709,9 +709,9 @@
       }
     },
     "node_modules/@grpc/grpc-js": {
-      "version": "1.14.4",
-      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@grpc/grpc-js/-/grpc-js-1.14.4.tgz",
-      "integrity": "sha1-5z/1fZeALwY5mVRfQ+uyseymXZ0=",
+      "version": "1.14.5",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@grpc/grpc-js/-/grpc-js-1.14.5.tgz",
+      "integrity": "sha512-7VZM+SVdEcUUqSQeNI3zM8Qs/BhQKZndPo2h5VkYkAM8Iz0wJIa8mKV5ekQGqG8UUsnkQ0NMxIxwkIHYvj0qOw==",
       "license": "Apache-2.0",
       "dependencies": {
         "@grpc/proto-loader": "^0.8.0",
diff --git a/samples/aks-langchain/package-lock.json b/samples/aks-langchain/package-lock.json
index 4c14425..209dc3b 100644
--- a/samples/aks-langchain/package-lock.json
+++ b/samples/aks-langchain/package-lock.json
@@ -244,9 +244,9 @@
       }
     },
     "node_modules/@grpc/grpc-js": {
-      "version": "1.14.4",
-      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@grpc/grpc-js/-/grpc-js-1.14.4.tgz",
-      "integrity": "sha1-5z/1fZeALwY5mVRfQ+uyseymXZ0=",
+      "version": "1.14.5",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@grpc/grpc-js/-/grpc-js-1.14.5.tgz",
+      "integrity": "sha512-7VZM+SVdEcUUqSQeNI3zM8Qs/BhQKZndPo2h5VkYkAM8Iz0wJIa8mKV5ekQGqG8UUsnkQ0NMxIxwkIHYvj0qOw==",
       "license": "Apache-2.0",
       "dependencies": {
         "@grpc/proto-loader": "^0.8.0",