CVE-2025-30350 Directus's S3 assets become unavailable after a burst of HEAD requests

Directus is a real-time API and App dashboard for managing SQL database content. The @directus/storage-driver-s3 package starting in version 9.22.0 and prior to version 12.0.1, corresponding to Directus starting in version 9.22.0 and prior to 11.5.0, is vulnerable to asset unavailability after a...

CVE-2025-30225

The CVE affects Directus users via the @directus/storage-driver-s3 driver: versions 9.22.0 up to 11.5.0 (paired Directus 9.22.0 to 11.5.0) are vulnerable to asset unavailability after a burst of malformed transformation requests, causing all assets to return 403 under load. The issue is fixed in ...

PT-2025-12977

Name of the Vulnerable Software and Affected Versions Directus versions 9.22.0 through 11.4.99 @directus/storage-driver-s3 versions 9.22.0 through 12.0.0 Description The issue affects the @directus/storage-driver-s3 package, causing asset unavailability after a burst of malformed transformations...