article Qlik Sense and Vulnerability “CVE-2025-7783” in NPM Library form-data in Official Support Articles

Qlik Sense and Vulnerability “CVE-2025-7783” in NPM Library form-data

Jamie_Gregory — Thu, 02 Oct 2025 14:14:08 GMT

Qlik Sense and Vulnerability “CVE-2025-7783” in NPM Library form-data

In mid-July 2025, a vulnerability was disclosed in the NPM library form-data (GitHub Security Advisory). Qlik became aware of this issue through its standard Secure Development Lifecycle (SDL) processes.

Following an internal review, Qlik R&D and Security teams identified that potentially vulnerable versions of the form-data library were included in some installations of Qlik Sense Enterprise for Windows. However, due to the specific way Qlik utilizes this library, the conditions required for exploitation are not met.

Although the vulnerability was determined to be non-exploitable within Qlik Sense, customers who prefer to upgrade to a version that includes the patched form-data library can do so by installing one of the following releases:

May 2025 Patch 6
November 2024 Patch 18
May 2024 Patch 24

Note: An earlier version of this information was mistakenly published indicating that this CVE was directly related to Qlik Sense for Windows.

Re: Critical Security fixes for Qlik Sense Enterprise for Windows (CVE-2025-7783)

Thorsten_Grund — Wed, 01 Oct 2025 07:09:51 GMT

Good morning!

I noticed the “Published date” for May 2025 Patch 6 hasn’t changed—just checking: is that still the current version with the fix included?

Thanks so much!

Re: Critical Security fixes for Qlik Sense Enterprise for Windows (CVE-2025-7783)

jeremyseipel — Wed, 01 Oct 2025 12:20:13 GMT

Will there be a patch for November 2023, since i believe it is technically still covered under support?

Re: Critical Security fixes for Qlik Sense Enterprise for Windows (CVE-2025-7783)

steeefan — Wed, 01 Oct 2025 13:03:40 GMT

There is also a Patch 7 available for May 2025, released today (01.10.2025), that isn't mentioned in the release notes. It's almost doubel the size of Patch 6 (560mb compared to 293mb). What's that about?

Re: Critical Security fixes for Qlik Sense Enterprise for Windows (CVE-2025-7783)

salshute — Wed, 01 Oct 2025 14:47:49 GMT

I am also interested to know @steeefan and @Jamie_Gregory as we are planning on upgrading a major global client in a few hours

Re: Qlik Sense and Vulnerability “CVE-2025-7783” in NPM Library form-data

QlikRockStar — Thu, 02 Oct 2025 15:19:38 GMT

The Ministry of Information Security in Germany is still listing the CVE as critical - and this is where a lot of customers are watching. Warn- und Informationsdienst - Sicherheitshinweis At least the article is back online, but customers are confused. In addition the missing info about Patch 7. Is there a way to revoke the CVE?

Re: Qlik Sense and Vulnerability “CVE-2025-7783” in NPM Library form-data

steeefan — Thu, 02 Oct 2025 15:25:12 GMT

I noticed that Patch 7 is now listed in the release notes. What I don't understand is why this patch is all off a sudden twice the size of the previous one.

Re: Qlik Sense and Vulnerability “CVE-2025-7783” in NPM Library form-data

jseipel — Thu, 02 Oct 2025 19:51:26 GMT

For anyone with clients that have yet to upgrade to newer releases, I submitted a ticket to Qlik on this and got the following response about prior versions, specifically around November 2023.

----

Lewis Ongeri

Oct 2, 2025

Hello Jeremy,

Yes I checked that November 2023 is still supported until November 14, 2025. However, this I have checked with the development and security teams and unfortunately, they are no plans to backport changes to the older versions i.e. November 2023.

------

Re: Qlik Sense and Vulnerability “CVE-2025-7783” in NPM Library form-data

David_Friend — Fri, 03 Oct 2025 15:08:54 GMT

@steeefan

We understand this patch exceeds our standard update size. This is due to a fix addressing a core system component that is infrequently modified. Due to architectural dependencies, deploying changes to this component requires the inclusion of its complete file set, resulting in the larger-than-usual patch size.