CVE-2025-30350

Name of the Vulnerable Software and Affected Versions Directus versions 9.22.0 through 11.4.99 @directus/storage-driver-s3 versions 9.22.0 through 12.0.0

Description The issue affects the @directus/storage-driver-s3 package, causing asset unavailability after a burst of HEAD requests. Some tools use the HEAD method to check the existence of files, and when making many HEAD requests at once, all assets are eventually served as 403, resulting in denial of assets for all policies of Directus, including Admin and Public.

Recommendations For Directus versions 9.22.0 through 11.4.99, update the @directus/storage-driver-s3 package to version 12.0.1 or later. For @directus/storage-driver-s3 versions 9.22.0 through 12.0.0, update to version 12.0.1 or later.