CVE-2025-30350: Directus S3 storage socket exhaustion with HEAD requests

CVE-2025-30350 · Severity: low · CVSS 3.1 · Published 2025-03-26

Directus is a headless CMS and content management platform that stores media assets in Amazon S3 cloud storage. A vulnerability in how it handles HEAD requests (used by syncing tools like Shopify to check file existence) causes socket connections to be left open without being consumed, exhausting the connection pool and making all assets unavailable to users with 403 errors.

Technologies: directus (npm). Vendors: Directus, npm.

Quick answers

Is CVE-2025-30350 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-30350 being exploited in the wild.
How severe is CVE-2025-30350?
Low severity, with a CVSS score of 3.1, published 26 March 2025.
Which products and versions are affected?
Directus Storage-Driver-S3 >=9.22.0 <12.0.1; @directus/storage-driver-s3 (npm) SEMVER:introduced=9.22.0,fixed=12.0.1; directus (npm) ECOSYSTEM:introduced=9.22,fixed=11.5.0.
Is there a fix for CVE-2025-30350?
Yes. @directus/storage-driver-s3 (npm): upgrade to 12.0.1 or later; directus (npm): upgrade to 11.5.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-30350 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2025-30350?
Check whether you run Directus Storage-Driver-S3, @directus/storage-driver-s3 (npm) or directus (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @directus/storage-driver-s3 (npm): upgrade to 12.0.1 or later
    npm install @directus/storage-driver-s3@12.0.1
  • directus (npm): upgrade to 11.5.0 or later
    npm install directus@11.5.0

Technical details

The vulnerability exists in Directus's S3 storage driver when handling HTTP HEAD requests. The root cause is improper stream handling in the AWS SDK integration: when a stream is requested from the S3 client but not consumed by the application code, it hangs indefinitely and holds a socket connection. After a burst of HEAD requests, all available sockets (controlled by STORAGE_CLOUD_MAX_SOCKETS) become exhausted, making new connections impossible and causing all subsequent asset requests to fail with 403 errors. This affects both the @directus/storage-driver-s3 package (>=9.22.0, fixed in 12.0.1) and the main directus package (>=9.22, fixed in 11.5.0). The issue is easily triggered and requires no authentication or user interaction, as HEAD requests are commonly issued by automated tools and CDNs.

Affected products

  • Directus Directus >=9.22 <11.5.0
  • Directus Storage Driver S3 >=9.22.0 <12.0.1

Identifiers

  • CVE-2025-30350
  • GHSA-rv78-qqrq-73m5

Timeline

  • 2025-03-26: disclosed
  • 2025-03-26: patched: Directus 11.5.0 and @directus/storage-driver-s3 12.0.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.