CVE-2025-30225 Directus's S3 assets become unavailable after a burst of malformed transformations
Attackers can cause all S3 assets to become unavailable by sending a burst of malformed transformation requests, affecting all user roles.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-30225?
CVE-2025-30225 is a medium-severity denial of service vulnerability in Monospace Directus, published on 26 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Directus is a real-time API and App dashboard for managing SQL database content. The `@directus/storage-driver-s3` package starting in version 9.22.0 and prior to version 12.0.1, corresponding to Directus starting in version 9.22.0 and prior to 11.5.0, is vulnerable to asset unavailability after a burst of malformed transformations. When making many malformed transformation requests at once, at some point, all assets are served as 403. This causes denial of assets for all policies of Directus, including Admin and Public. Version 12.0.1 of the `@directus/storage-driver-s3` package, corresponding to version 11.5.0 of Directus, fixes the issue.
Weakness: CWE-770
Which versions are affected by CVE-2025-30225?
4 open source packages ship an affected version, including @directus/storage-driver-s3 and directus. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@directus/storage-driver-s3 npm | From 9.22.0 | 12.0.1 |
@directus/storage-driver-s3 npm | From 9.22.0 | 12.0.1 |
directus npm | From 9.22.0 | 11.5.0 |
directus npm | From 9.22.0 | 11.5.0 |
Products include Monospace Directus.
How do I fix CVE-2025-30225?
Upgrade @directus/storage-driver-s3 to 12.0.1 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-30225 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-30225 exists.
Other vulnerabilities in Monospace Directus
- CVE-2022-26969 Insecure default value for CORS configuration
- CVE-2025-55746 Directus allows unauthenticated file upload and file modification due to lacking input sanitization
- CVE-2026-35408 Directus is Missing Cross-Origin Opener Policy
- CVE-2026-61836 Directus: Authorization-dependent response served from unsegmented cache key
- CVE-2025-30353 Directus's webhook trigger flows can leak sensitive data
Sources
Also known as GHSA-j8xj-7jff-46mx.