Description
When making many malformed transformation requests at once, at some point, all assets are being served as 403.
Recommendation
Update the @directus/storage-driver-s3 package to the latest compatible version. Followings are version details:
- Affected version(s): >= 9.22.0, < 12.0.1
- Patched version(s): 12.0.1
References
Could your website be exposed too?
SmartScanner can check your website for Directus's S3 assets become unavailable after a burst of malformed transformations and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Directus's S3 assets become unavailable after a burst of HEAD requests - CVE-2025-30350
- Payload does not invalidate JWTs after log out - payload - CVE-2025-4643
- Payload does not invalidate JWTs after log out - @payloadcms/next - CVE-2025-4643
- Payload does not invalidate JWTs after log out - CVE-2025-4643
You might also like:
See something that needs correcting? Let us knowUpdated March 27, 2025