Description
There’s some tools that use Directus to sync content and assets. Some of those tools use HEAD method, like Shopify, to check the existence of files. Although, when making many HEAD requests at once, at some point, all assets are being served as 403.
Recommendation
Update the @directus/storage-driver-s3 package to the latest compatible version. Followings are version details:
- Affected version(s): >= 9.22.0, < 12.0.1
- Patched version(s): 12.0.1
References
Could your website be exposed too?
SmartScanner can check your website for Directus's S3 assets become unavailable after a burst of HEAD requests and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Directus's S3 assets become unavailable after a burst of malformed transformations - CVE-2025-30225
- axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL - CVE-2025-27152
- Qwik's unhandled exception vulnerabilty can cause server crashes from malicious requests - CVE-2025-53620
- Suspended Directus user can continue to use session token to access API - CVE-2025-30351
You might also like:
See something that needs correcting? Let us knowUpdated March 27, 2025