diff --git a/requirements.txt b/requirements.txt
index 204d7318ab5..ab96d3cf03f 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -31,7 +31,7 @@ mdx_truly_sane_lists==1.3
 markdown-link-attr-modifier==0.2.1
 mdx-gh-links==0.4
 # Sanitize HTML documentation output to prevent XSS from translators
-nh3==0.2.17
+nh3==0.2.18
 
 # For building developer documentation
 sphinx==7.2.6
diff --git a/user_docs/en/changes.md b/user_docs/en/changes.md
index b1ae8743159..a929485a220 100644
--- a/user_docs/en/changes.md
+++ b/user_docs/en/changes.md
@@ -51,6 +51,7 @@ Please refer to [the developer guide](https://www.nvaccess.org/files/nvda/docume
   * Updated py2exe to 0.13.0.2 (#16907, @dpy013)
   * Updated setuptools to 72.0 (#16907, @dpy013)
   * Updated Ruff to 0.5.6. (#16868, @LeonarddeR)
+  * Updated nh3 0.2.17 to 0.2.18 (#17020, @dpy013)
 * Added a `.editorconfig` file to NVDA's repository in order for several IDEs to pick up basic NVDA code style rules by default. (#16795, @LeonarddeR)
 * Added support for custom speech symbol dictionaries. (#16739, #16823, @LeonarddeR)
   * Dictionaries can be provided in locale specific folders in an add-on package, e.g. `locale\en`.