CVE-2025-30350 Directus's S3 assets become unavailable after a burst of HEAD requests
Attackers can cause asset unavailability in Directus by sending a burst of HEAD requests, denying access to all users including admins.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-30350?
CVE-2025-30350 is a medium-severity denial of service vulnerability in Monospace Directus, published on 26 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Directus is a real-time API and App dashboard for managing SQL database content. The `@directus/storage-driver-s3` package starting in version 9.22.0 and prior to version 12.0.1, corresponding to Directus starting in version 9.22.0 and prior to 11.5.0, is vulnerable to asset unavailability after a burst of HEAD requests. Some tools use Directus to sync content and assets, and some of those tools use the HEAD method to check the existence of files. When making many HEAD requests at once, at some point, all assets are eventually served as 403. This causes denial of assets for all policies of Directus, including Admin and Public. Version 12.0.1 of the `@directus/storage-driver-s3` package, corresponding to version 11.5.0 of Directus, fixes the issue.
Weakness: CWE-770
Which versions are affected by CVE-2025-30350?
4 open source packages ship an affected version, including @directus/storage-driver-s3 and directus. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@directus/storage-driver-s3 npm | From 9.22.0 | 12.0.1 |
@directus/storage-driver-s3 npm | From 9.22.0 | 12.0.1 |
directus npm | From 9.22 | 11.5.0 |
directus npm | From 9.22 | 11.5.0 |
Products include Monospace Directus.
How do I fix CVE-2025-30350?
Upgrade @directus/storage-driver-s3 to 12.0.1 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-30350 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-30350 exists.
Other vulnerabilities in Monospace Directus
- CVE-2022-26969 Insecure default value for CORS configuration
- CVE-2025-55746 Directus allows unauthenticated file upload and file modification due to lacking input sanitization
- CVE-2026-35408 Directus is Missing Cross-Origin Opener Policy
- CVE-2026-61836 Directus: Authorization-dependent response served from unsegmented cache key
- CVE-2025-30353 Directus's webhook trigger flows can leak sensitive data
Sources
Also known as GHSA-rv78-qqrq-73m5.