Denial Of Service (DoS)

@directus/storage-driver-s3 is vulnerable to Denial Of Service DoS. The vulnerability is due to asset unavailability caused by excessive HEAD requests, which allows an attacker to trigger 403 errors for all assets and deny access across all Directus policies...

CVE-2025-30225

Directus is a real-time API and App dashboard for managing SQL database content. The @directus/storage-driver-s3 package starting in version 9.22.0 and prior to version 12.0.1, corresponding to Directus starting in version 9.22.0 and prior to 11.5.0, is vulnerable to asset unavailability after a...

@arc-directus/api (>=12.0.0, <=12.0.6), @deconz-community/directus-extension-ddf-store (0.1.0) +21 more potentially affected by CVE-2025-30350 via @directus/storage-driver-s3 (>=9.22.0, <=12.0.0)

@directus/storage-driver-s3 NPM version =9.22.0, =12.0.0, =9.25.0, =1.2.2, =11.1.0, =10.3.1, =1.0.5, =1.0.10, =0.1.0, =9.22.0, =11.4.1 and more Source cves: CVE-2025-30350 Source advisory: GHSA-RV78-QQRQ-73M5...

@arc-directus/api (>=12.0.0, <=12.0.6), @deconz-community/directus-extension-ddf-store (0.1.0) +21 more potentially affected by CVE-2025-30350 via @directus/storage-driver-s3 (>=9.22.0, <=12.0.0)

@directus/storage-driver-s3 NPM version =9.22.0, =12.0.0, =9.25.0, =1.2.2, =11.1.0, =10.3.1, =1.0.5, =1.0.10, =0.1.0, =9.22.0, =11.4.1 and more Source cves: CVE-2025-30350 Source advisory: OSV:GHSA-RV78-QQRQ-73M5...

@arc-directus/api (>=12.0.0, <=12.0.6), @deconz-community/directus-extension-ddf-store (0.1.0) +21 more potentially affected by CVE-2025-30225 via @directus/storage-driver-s3 (>=9.22.0, <=12.0.0)

@directus/storage-driver-s3 NPM version =9.22.0, =12.0.0, =9.25.0, =1.2.2, =11.1.0, =10.3.1, =1.0.5, =1.0.10, =0.1.0, =9.22.0, =11.4.1 and more Source cves: CVE-2025-30225 Source advisory: GHSA-J8XJ-7JFF-46MX...

@arc-directus/api (>=12.0.0, <=12.0.6), @deconz-community/directus-extension-ddf-store (0.1.0) +21 more potentially affected by CVE-2025-30225 via @directus/storage-driver-s3 (>=9.22.0, <=12.0.0)

@directus/storage-driver-s3 NPM version =9.22.0, =12.0.0, =9.25.0, =1.2.2, =11.1.0, =10.3.1, =1.0.5, =1.0.10, =0.1.0, =9.22.0, =11.4.1 and more Source cves: CVE-2025-30225 Source advisory: OSV:GHSA-J8XJ-7JFF-46MX...

CVE-2025-30350

Directus is a real-time API and App dashboard for managing SQL database content. The "@directus/storage-driver-s3" package starting in version 9.22.0 and prior to version 12.0.1, corresponding to Directus starting in version 9.22.0 and prior to 11.5.0, is vulnerable to asset unavailability after ...

@arc-directus/api (>=12.0.0, <=12.0.6), @deconz-community/directus-extension-ddf-store (0.1.0) +21 more potentially affected by CVE-2025-30350 via @directus/storage-driver-s3 (>=9.22.0, <=12.0.0)

@directus/storage-driver-s3 NPM version =9.22.0, =12.0.0, =9.25.0, =1.2.2, =11.1.0, =10.3.1, =1.0.5, =1.0.10, =0.1.0, =9.22.0, =11.4.1 and more Source cves: CVE-2025-30350 Source advisory: MEND:CVE-2025-30350...

CVE-2025-30225

Directus is a real-time API and App dashboard for managing SQL database content. The "@directus/storage-driver-s3" package starting in version 9.22.0 and prior to version 12.0.1, corresponding to Directus starting in version 9.22.0 and prior to 11.5.0, is vulnerable to asset unavailability after ...

@arc-directus/api (>=12.0.0, <=12.0.6), @deconz-community/directus-extension-ddf-store (0.1.0) +21 more potentially affected by CVE-2025-30225 via @directus/storage-driver-s3 (>=9.22.0, <=12.0.0)

@directus/storage-driver-s3 NPM version =9.22.0, =12.0.0, =9.25.0, =1.2.2, =11.1.0, =10.3.1, =1.0.5, =1.0.10, =0.1.0, =9.22.0, =11.4.1 and more Source cves: CVE-2025-30225 Source advisory: MEND:CVE-2025-30225...

CVE-2025-30225 Directus's S3 assets become unavailable after a burst of malformed transformations

Directus is a real-time API and App dashboard for managing SQL database content. The @directus/storage-driver-s3 package starting in version 9.22.0 and prior to version 12.0.1, corresponding to Directus starting in version 9.22.0 and prior to 11.5.0, is vulnerable to asset unavailability after a...

PT-2025-12978

Name of the Vulnerable Software and Affected Versions Directus versions 9.22.0 through 11.4.99 @directus/storage-driver-s3 versions 9.22.0 through 12.0.0 Description The issue affects the @directus/storage-driver-s3 package, causing asset unavailability after a burst of HEAD requests. Some tools...

PT-2025-12977

Name of the Vulnerable Software and Affected Versions Directus versions 9.22.0 through 11.4.99 @directus/storage-driver-s3 versions 9.22.0 through 12.0.0 Description The issue affects the @directus/storage-driver-s3 package, causing asset unavailability after a burst of malformed transformations...

CVE-2025-30350: Allocation of Resources Without Limits or Throttling

Directus is a real-time API and App dashboard for managing SQL database content. The @directus/storage-driver-s3 package starting in version 9.22.0 and prior to version 12.0.1, corresponding to Directus starting in version 9.22.0 and prior to 11.5.0, is vulnerable to asset unavailability after a...

CVE-2025-30225: Allocation of Resources Without Limits or Throttling

Directus is a real-time API and App dashboard for managing SQL database content. The @directus/storage-driver-s3 package starting in version 9.22.0 and prior to version 12.0.1, corresponding to Directus starting in version 9.22.0 and prior to 11.5.0, is vulnerable to asset unavailability after a...

@angular-devkit/build-angular (>=17.1.0-next.1, <=17.2.0-next.1), @directus/api (15.0.0) +16 more potentially affected by CVE-2024-24750 via undici (>=6.0.0, <=6.5.0)

undici NPM version =6.0.0, =17.1.0-next.1, =1.0.0, =17.0.0, =1.0.5, =5.3.0, =4.1.0, =4.2.0 - directus 10.8.3 and more Source cves: CVE-2024-24750 Source advisory: GHSA-9F24-JQHM-JFCW...