CVE-2026-35441: Directus GraphQL DOS Vulnerability

CVE-2026-35441 Overview

A GraphQL resource exhaustion vulnerability has been identified in Directus, a real-time API and App dashboard for managing SQL database content. Prior to version 11.17.0, Directus' GraphQL endpoints (/graphql and /graphql/system) did not deduplicate resolver invocations within a single request, allowing authenticated users to exploit GraphQL aliasing to cause denial of service conditions.

Critical Impact
Any authenticated user, including those with minimal read-only permissions, can exploit this vulnerability to cause CPU, memory, and I/O exhaustion, potentially degrading or crashing the Directus service.

Affected Products

Directus versions prior to 11.17.0
Directus GraphQL endpoints (/graphql and /graphql/system)
Self-hosted and managed Directus deployments with default configurations

Discovery Timeline

April 6, 2026 - CVE-2026-35441 published to NVD
April 7, 2026 - Last updated in NVD database

Technical Details for CVE-2026-35441

Vulnerability Analysis

This vulnerability falls under CWE-400 (Uncontrolled Resource Consumption), a class of weaknesses that occur when an application does not properly restrict the amount of resources consumed by a user or process. In this case, the Directus GraphQL implementation fails to deduplicate resolver invocations when processing aliased queries within a single request.

GraphQL aliasing is a legitimate feature that allows clients to request the same field multiple times with different arguments or simply different names in the response. However, when combined with expensive relational queries, this feature can be weaponized. An attacker can craft a single GraphQL request containing numerous aliases, each triggering an independent complex database query. The database load multiplies linearly with the number of aliases included in the request.

The existing security controls proved insufficient to prevent exploitation. While Directus implements a token limit on GraphQL queries, it still permits enough aliases to cause significant resource exhaustion. The relational depth limit applies per alias without reducing the total number of queries executed. Furthermore, rate limiting is disabled by default, meaning no built-in throttle prevents this attack from causing service degradation or complete denial of service.

Root Cause

The root cause lies in the GraphQL resolver implementation's failure to recognize and deduplicate repeated query patterns when processing aliased fields. Each alias is treated as an independent query requiring full resolution, regardless of whether identical or similar queries have already been processed within the same request. This architectural oversight allows the linear multiplication of database operations based on the number of aliases in a single request.

Attack Vector

The attack can be executed by any authenticated user over the network, including those with minimal read-only permissions. The attacker sends a specially crafted GraphQL request to either the /graphql or /graphql/system endpoint containing multiple aliases that each invoke expensive relational queries. Because the server processes each alias independently without deduplication, the cumulative database load can exhaust server resources including CPU, memory, and I/O bandwidth.

The vulnerability is exploited through GraphQL aliasing, where an attacker repeats expensive relational queries using different alias names within a single request. Each alias forces the server to execute an independent database query, causing linear multiplication of database load. The attack requires only basic authentication and read permissions, making it accessible to any authenticated user. For technical implementation details, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-35441

Indicators of Compromise

Abnormally large GraphQL requests to /graphql or /graphql/system endpoints containing numerous field aliases
Sudden spikes in database query volume originating from the Directus application
Increased CPU, memory, or I/O utilization on servers hosting Directus
Service degradation or unresponsiveness affecting Directus API availability

Detection Strategies

Monitor GraphQL request payloads for excessive use of aliasing patterns in incoming queries
Implement query complexity analysis to identify requests that may cause disproportionate resource consumption
Set up alerting for abnormal database query patterns or connection pool exhaustion
Review application logs for repeated expensive relational queries from single sessions

Monitoring Recommendations

Enable detailed logging for GraphQL endpoint requests including payload size and execution time
Configure database query monitoring to track query counts and execution duration per application session
Set up resource utilization alerts for CPU, memory, and disk I/O on Directus server infrastructure
Implement application performance monitoring (APM) to correlate user requests with backend resource consumption

How to Mitigate CVE-2026-35441

Immediate Actions Required

Upgrade Directus to version 11.17.0 or later immediately
Enable rate limiting on GraphQL endpoints if running a vulnerable version
Consider implementing a Web Application Firewall (WAF) rule to limit GraphQL query complexity
Restrict GraphQL endpoint access to only necessary authenticated users

Patch Information

The vulnerability is fixed in Directus version 11.17.0. Organizations should upgrade to this version or later to remediate the vulnerability. The fix implements proper deduplication of resolver invocations to prevent the linear multiplication of database queries through aliasing. For additional details, consult the GitHub Security Advisory.

Workarounds

Enable rate limiting on Directus GraphQL endpoints to throttle request frequency
Implement query complexity limits at the reverse proxy or WAF layer
Reduce the token limit on GraphQL queries to further restrict alias abuse potential
Consider disabling GraphQL endpoints for users who do not require GraphQL access

bash

# Example: Enable rate limiting in Directus configuration
# Add to your .env or environment configuration
RATE_LIMITER_ENABLED=true
RATE_LIMITER_POINTS=50
RATE_LIMITER_DURATION=1