diff --git a/CHANGELOG.md b/CHANGELOG.md
index 45c8cb89..f9f75d0f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,12 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 
 ## [Unreleased]
 
+## [16.0.4] - 2022-04-29
+
+### Fixed
+
+- Remove vulnerable version of `cross-fetch` ([#404](https://github.com/MetaMask/web3-provider-engine/pull/404))
+
 ## [16.0.3] - 2021-07-15
 
 ### Changed
diff --git a/package.json b/package.json
index b1c89a4e..4c2d01ca 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "web3-provider-engine",
-  "version": "16.0.3",
+  "version": "16.0.4",
   "description": "A JavaScript library for composing Ethereum provider objects using middleware modules",
   "repository": "https://github.com/MetaMask/web3-provider-engine",
   "main": "index.js",