Directus's S3 assets become unavailable after a burst of HEAD requests

Description

There’s some tools that use Directus to sync content and assets. Some of those tools use HEAD method, like Shopify, to check the existence of files. Although, when making many HEAD requests at once, at some point, all assets are being served as 403.

Recommendation

Update the @directus/storage-driver-s3 package to the latest compatible version. Followings are version details:

• Affected version(s): >= 9.22.0, < 12.0.1
• Patched version(s): 12.0.1

References

• GHSA-rv78-qqrq-73m5
• CVE-2025-30350
• CWE-770
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Directus's S3 assets become unavailable after a burst of malformed transformations - CVE-2025-30225
• axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL - CVE-2025-27152
• Qwik's unhandled exception vulnerabilty can cause server crashes from malicious requests - CVE-2025-53620
• Suspended Directus user can continue to use session token to access API - CVE-2025-30351

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

@directus/storage-driver-s3