CVE-2026-35441: 
JavaScript vulnerability analysis and mitigation

CVE-2026-35441 is a GraphQL Alias Amplification Denial-of-Service vulnerability in Directus, an open-source headless CMS, caused by missing query cost and complexity limits on its GraphQL endpoints. The vulnerability affects all Directus (npm) versions prior to 11.17.0 and was published on April 2, 2026, with the advisory added to the GitHub Advisory Database on April 4, 2026. It carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, Directus Advisory).

The root cause is uncontrolled resource consumption (CWE-400) and allocation of resources without limits or throttling (CWE-770) in Directus' GraphQL endpoints (/graphql and /graphql/system). The endpoints did not deduplicate resolver invocations within a single request, allowing an attacker to use GraphQL aliasing to invoke the same expensive relational resolver many times in one request — each alias triggering an independent, complex database query executed concurrently. The existing token limit on GraphQL queries still permitted enough aliases for significant resource exhaustion, and the relational depth limit applied per alias rather than reducing the total number of queries executed. Because rate limiting is disabled by default in Directus, no built-in throttle existed to prevent this amplification from exhausting CPU, memory, and I/O resources (GitHub Advisory, Directus Advisory).

Successful exploitation causes service degradation or complete outage of the Directus instance, as concurrent complex database queries exhaust the connection pool and server resources, affecting all users of the platform. The impact scales linearly with the number of aliases used and the depth of relational queries, and is further compounded when multiple simultaneous requests are sent. There is no confidentiality or integrity impact — the vulnerability is purely an availability concern — but a full service crash could disrupt all dependent applications and workflows (GitHub Advisory).

Any authenticated user, including those with minimal read-only permissions on a single collection, can trigger this condition, making the attack surface broad within any multi-tenant or user-accessible Directus deployment. No public exploit code or in-the-wild exploitation has been reported as of the available data. The EPSS score is approximately 0.032% (0.000320), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, Directus Advisory).

1. Obtain authentication credentials: Acquire any valid Directus account, including a low-privilege read-only user account for a single collection.
2. Identify the target endpoint: Locate the Directus instance's GraphQL endpoint at /graphql (for item collections) or /graphql/system (for system resources).
3. Craft an aliased GraphQL query: Construct a GraphQL query that uses many aliases to invoke the same expensive relational resolver repeatedly within a single request. For example:

query {
  a1: some_collection { related_items { nested_items { id name } } }
  a2: some_collection { related_items { nested_items { id name } } }
  a3: some_collection { related_items { nested_items { id name } } }
  # ... repeated up to the token limit
}

4. Send the request: Submit the crafted query via an authenticated HTTP POST request to the GraphQL endpoint, including the user's authentication token in the Authorization header.
5. Amplify with concurrency: Send multiple such requests simultaneously to multiply the database load further, exhausting the connection pool and server resources.
6. Achieve denial of service: The server executes all aliased resolver calls as independent database queries concurrently, causing CPU, memory, and I/O exhaustion that degrades or crashes the Directus service for all users (GitHub Advisory, Directus Advisory).

• Network: High volume of HTTP POST requests to /graphql or /graphql/system from a single authenticated user or IP address; requests with unusually large GraphQL query bodies containing many aliased fields.
• Logs: Directus application logs showing a spike in concurrent database query executions; database connection pool exhaustion errors or timeout messages; repeated identical resolver calls within single request traces.
• Process/Resource: Sudden spikes in CPU, memory, and I/O utilization on the Directus server or database host; database connection pool saturation; service unresponsiveness or crashes correlated with specific authenticated user activity.
• Application: Increased response latency or HTTP 503/504 errors from the Directus API coinciding with GraphQL endpoint traffic spikes (GitHub Advisory).

Directus has released version 11.17.0 as the patched release, which introduces a request-scoped resolver deduplication mechanism across all GraphQL read resolvers (both system and items endpoints). When multiple aliases in a single request invoke the same resolver with identical arguments, only the first call executes and all subsequent aliases share its result, eliminating the amplification factor. As an interim workaround for deployments that cannot immediately upgrade, administrators should enable rate limiting on the Directus instance (disabled by default) to throttle excessive GraphQL requests. Upgrading to 11.17.0 or later is the recommended and definitive remediation (GitHub Advisory, Directus Advisory).

The vulnerability was reported by security researcher liyander and the advisory was published by br41nslug on the Directus GitHub repository on April 2, 2026. Coverage has been picked up by vulnerability tracking services including CVEFeed, VulDB, and Infinit Security, with the latter publishing a dedicated write-up on the GraphQL alias amplification technique. No major vendor statements beyond the official Directus advisory or notable social media controversy have been identified (GitHub Advisory, Directus Advisory).