Search for packages
| purl | pkg:npm/directus@11.17.0 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-c6w9-5g5j-jh2p
Aliases: CVE-2026-61836 |
Directus: Authorization-dependent response served from unsegmented cache key ## Summary When response caching is enabled (`CACHE_ENABLED=true`), the cache-key derivation in … |
Not vulnerable |
|
GHSA-j5h6-vqc3-phqh
Aliases: CVE-2026-61835 |
Directus: SSRF Protection Bypass via 0.0.0.0 in File Import ### Summary The SSRF protection on Directus's file-import-from-URL feature can be … |
Not vulnerable |
| Advisory | Summary | Aliases |
|---|---|---|
|
GHSA-393c-p46r-7c95
|
Directus: Path Traversal and Broken Access Control in File Management API ## Summary A broken access control vulnerability was identified … |
CVE-2026-39942
|
|
GHSA-6q22-g298-grjh
|
Directus: Unauthenticated Denial of Service via GraphQL Alias Amplification of Expensive Health Check Resolver ## Summary The GraphQL specification permits … | |
|
GHSA-mvv8-v4jj-g47j
|
Directus: Sensitive fields exposed in revision history ### Summary Directus stores revision records (in `directus_revisions`) whenever items are created or … |
CVE-2026-39943
|
|
GHSA-38hg-ww64-rrwc
|
Directus: Authenticated Users Can Extract Concealed Fields via Aggregate Queries ### Summary Aggregate functions (`min`, `max`) applied to fields with … |
CVE-2026-35442
|
|
GHSA-ph52-67fq-75wj
|
Directus: GraphQL Alias Amplification Denial of Service Due to Missing Query Cost/Complexity Limits ### Summary Directus' GraphQL endpoints (`/graphql` and … |
CVE-2026-35441
|
|
GHSA-8m32-p958-jg99
|
Directus: Missing Cross-Origin Opener Policy ## Summary Directus's Single Sign-On (SSO) login pages lacked a `Cross-Origin-Opener-Policy` (COOP) HTTP response header. … |
CVE-2026-35408
|
|
GHSA-393c-p46r-7c95
|
Directus: Path Traversal and Broken Access Control in File Management API A broken access control vulnerability was identified in the … | |
|
GHSA-mvv8-v4jj-g47j
|
Directus: Sensitive fields exposed in revision history Directus stores revision records (in `directus_revisions`) whenever items are created or updated. Due … |