diff --git a/services/web/frontend/js/features/pdf-preview/util/pdf-js-wrapper.js b/services/web/frontend/js/features/pdf-preview/util/pdf-js-wrapper.js
index a8e8a9756f..68d59492c8 100644
--- a/services/web/frontend/js/features/pdf-preview/util/pdf-js-wrapper.js
+++ b/services/web/frontend/js/features/pdf-preview/util/pdf-js-wrapper.js
@@ -42,6 +42,7 @@ export default class PDFJSWrapper {
       linkService,
       // l10n, // commented out since it currently breaks `aria-label` rendering in pdf pages
       enableScripting: false, // default is false, but set explicitly to be sure
+      enableXfa: false, // default is false (2021-10-12), but set explicitly to be sure
       renderInteractiveForms: false,
     })
 
diff --git a/services/web/package-lock.json b/services/web/package-lock.json
index 01d811a59a..13411ecb5c 100644
--- a/services/web/package-lock.json
+++ b/services/web/package-lock.json
@@ -28987,9 +28987,9 @@
       }
     },
     "pdfjs-dist": {
-      "version": "2.9.359",
-      "resolved": "https://registry.npmjs.org/pdfjs-dist/-/pdfjs-dist-2.9.359.tgz",
-      "integrity": "sha512-P2nYtkacdlZaNNwrBLw1ZyMm0oE2yY/5S/GDCAmMJ7U4+ciL/D0mrlEC/o4HZZc/LNE3w8lEVzBEyVgEQlPVKQ=="
+      "version": "2.10.377",
+      "resolved": "https://registry.npmjs.org/pdfjs-dist/-/pdfjs-dist-2.10.377.tgz",
+      "integrity": "sha512-i0jRShtvgfsVQUNCoFYH4SVhPO3U0yhtiFLfZ0RR0B+68N+Vnwq+8B3cjWjLEwWGh8wg1XQ/sYMYKUlHn/Qpsw=="
     },
     "pend": {
       "version": "1.2.0",
diff --git a/services/web/package.json b/services/web/package.json
index a5cd6139fd..413951c6ea 100644
--- a/services/web/package.json
+++ b/services/web/package.json
@@ -144,7 +144,7 @@
     "passport-orcid": "0.0.4",
     "passport-saml": "https://github.com/overleaf/passport-saml/releases/download/v3.0.0-overleaf/passport-saml-3.0.0-overleaf.tar.gz",
     "passport-twitter": "^1.0.4",
-    "pdfjs-dist": "^2.9.359",
+    "pdfjs-dist": "^2.10.377",
     "prop-types": "^15.7.2",
     "pug": "^3.0.1",
     "pug-runtime": "^3.0.1",