Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2025-30350
CVE-2025-30350:
JavaScript vulnerability analysis and mitigation
Overview
Directus, a real-time API and App dashboard for managing SQL database content, contains a vulnerability in the @directus/storage-driver-s3 package versions 9.22.0 to 12.0.1 (corresponding to Directus versions 9.22.0 to 11.5.0). The vulnerability was discovered on March 26, 2025, and allows asset unavailability after a burst of HEAD requests (GitHub Advisory).
Technical details
The vulnerability occurs when multiple HEAD requests are made simultaneously to check file existence. After a burst of HEAD requests, the number of sockets held on Agent on NodeHttpHandler reaches STORAGECLOUDMAX_SOCKETS, preventing new connections and causing assets to become inaccessible. The root cause is that when a stream is requested in AWS SDK, it needs to be consumed, otherwise it will hang indefinitely. The issue persists despite configured timeouts (GitHub Advisory).
Impact
When exploited, this vulnerability results in a denial of assets condition affecting all policies of Directus, including Admin and Public access. All assets eventually return 403 errors, making them inaccessible to users (GitHub Advisory).
Mitigation and workarounds
The vulnerability has been patched in @directus/storage-driver-s3 version 12.0.1 and Directus version 11.5.0. Users should upgrade to these versions or later to resolve the issue (GitHub Advisory).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management