CVE-2025-30350: Monospace Directus DoS Vulnerability

CVE-2025-30350 Overview

CVE-2025-30350 affects Directus, a real-time API and application dashboard for managing SQL database content. The vulnerability resides in the @directus/storage-driver-s3 package from version 9.22.0 up to but not including 12.0.1, corresponding to Directus versions 9.22.0 through 11.4.x. A burst of HTTP HEAD requests against asset endpoints causes the S3 storage driver to return HTTP 403 responses for all subsequent asset requests. The condition affects every access policy in Directus, including Admin and Public roles, resulting in denial of assets across the platform. This weakness maps to CWE-770: Allocation of Resources Without Limits or Throttling.

Critical Impact
A remote unauthenticated attacker can render all Directus-managed assets unavailable by sending a burst of HEAD requests, disrupting downstream content sync tools and public consumers.

Affected Products

Directus versions 9.22.0 through 11.4.x (Node.js distributions)
@directus/storage-driver-s3 package versions 9.22.0 through 12.0.0
Any deployment that uses Directus with an S3-backed storage driver

Discovery Timeline

2025-03-26 - CVE-2025-30350 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30350

Vulnerability Analysis

Directus exposes asset endpoints that proxy requests to an S3-compatible object store through the @directus/storage-driver-s3 package. External synchronization tools frequently issue HEAD requests to verify file existence before downloading. When many HEAD requests arrive in a short window, the storage driver reaches a state in which every subsequent asset response returns HTTP 403 Forbidden. The failure mode is not limited to the requesting client. All policies, including Admin and Public, are affected until the condition is resolved.

The result is a denial of service against asset delivery. Downstream integrations that rely on asset availability, such as content mirrors, static site generators, and CDN origin pulls, fail without producing an authentication error a user could remediate.

Root Cause

The underlying weakness is unthrottled resource allocation in the S3 driver's handling of HEAD requests. The driver does not bound concurrent connections, retries, or client state associated with existence checks. Under burst load, an internal limit is exhausted and the driver enters a state where authorization decisions fail closed, returning 403 for legitimate reads. The advisory tracks this as GHSA-rv78-qqrq-73m5.

Attack Vector

The attack requires only network access to a Directus asset endpoint. No authentication or user interaction is needed. An attacker scripts a burst of HEAD requests against /assets/<file-id> paths until the driver transitions into the failing state. Legitimate GET and HEAD traffic then receives 403 responses regardless of caller identity or policy.

No verified public proof-of-concept code is available. The vulnerability mechanism is described in the vendor advisory referenced above.

Detection Methods for CVE-2025-30350

Indicators of Compromise

Sudden spike in inbound HTTP HEAD requests to /assets/* endpoints from a single source or small set of sources
Sustained HTTP 403 responses for asset requests that previously succeeded, including for Admin-authenticated sessions
Downstream sync tools or CDN origin pulls reporting asset fetch failures without a corresponding permissions change in Directus

Detection Strategies

Alert on request-rate anomalies for the HEAD method against Directus asset routes, correlated with a rising 403 response ratio
Compare the ratio of 403 responses for the Public policy before and after traffic bursts to identify regression from availability baselines
Inspect reverse proxy or load balancer logs for repeated small-payload HEAD requests originating from non-browser user agents

Monitoring Recommendations

Instrument Directus with request logging that captures method, path, response code, and client identifier for asset endpoints
Forward Directus and reverse proxy logs to a centralized analytics platform and build a dashboard tracking asset 403 rates over time
Set a threshold alert on HEAD request bursts exceeding normal baselines by a defined multiple

How to Mitigate CVE-2025-30350

Immediate Actions Required

Upgrade Directus to version 11.5.0 or later, which bundles @directus/storage-driver-s3 version 12.0.1 with the fix
If immediate upgrade is not possible, place a rate limiter in front of Directus asset endpoints and restrict HEAD request bursts per source
Review external sync tools and configure them to serialize existence checks or use If-None-Match conditional GET requests instead of HEAD floods

Patch Information

The issue is fixed in @directus/storage-driver-s3 version 12.0.1, corresponding to Directus version 11.5.0. Upgrade paths and release notes are documented in the GitHub Security Advisory GHSA-rv78-qqrq-73m5.

Workarounds

Deploy a reverse proxy rule that limits concurrent HEAD requests per client IP against /assets/*
Cache asset existence responses at a CDN or reverse proxy layer so that repeated HEAD checks do not reach the Directus origin
Restart the Directus process to clear the failing driver state as a temporary recovery step while a permanent fix is deployed

bash

# Example nginx snippet to throttle HEAD requests to Directus asset endpoints
limit_req_zone $binary_remote_addr zone=directus_head:10m rate=10r/s;

location /assets/ {
    limit_except GET {
        limit_req zone=directus_head burst=20 nodelay;
    }
    proxy_pass http://directus_upstream;
}