Directus's S3 assets become unavailable after a burst of malformed transformations

Description

When making many malformed transformation requests at once, at some point, all assets are being served as 403.

Recommendation

Update the @directus/storage-driver-s3 package to the latest compatible version. Followings are version details:

• Affected version(s): >= 9.22.0, < 12.0.1
• Patched version(s): 12.0.1

References

• GHSA-j8xj-7jff-46mx
• CVE-2025-30225
• CWE-770
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Directus's S3 assets become unavailable after a burst of HEAD requests - CVE-2025-30350
• Payload does not invalidate JWTs after log out - payload - CVE-2025-4643
• Payload does not invalidate JWTs after log out - @payloadcms/next - CVE-2025-4643
• Payload does not invalidate JWTs after log out - CVE-2025-4643

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

@directus/storage-driver-s3