Directus WebSocket Crash Vulnerability in directus
Summary
CVE-2023-45820: Directus crashes on invalid WebSocket message. Affects directus versions >= 10.4.0, < 10.6.2. Fixed in 10.6.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Directus is an open-source headless CMS (Content Management System) that provides a user-friendly interface for managing content and data. It allows developers to create custom database schemas and build APIs to access and manipulate the data. Directus also supports real-time updates through WebSocket communication. However, a vulnerability has been discovered in Directus that can cause the server to crash when it receives an invalid WebSocket frame.
Vulnerability Detail
The vulnerability in Directus occurs when the WebSocket server receives an invalid frame, causing the server to crash with a 'RangeError: Invalid WebSocket frame: RSV2 and RSV3 must be clear' error. This vulnerability can be exploited by sending specially crafted invalid frames to a Directus server with WebSocket enabled. As a result, the server becomes unresponsive and needs to be manually restarted. This vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Latest published version: 12.5.0 as of 22 Oct 2026
npm install directus@12.5.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
10.6.2
This is the first release that contains the fix.
npm install directus@10.6.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to Directus version 10.6.2 or later to mitigate the risk.
Conclusion
The Directus WebSocket Crash vulnerability in directus can lead to server crashes and service unavailability. It is crucial to upgrade to the latest version of Directus (10.6.2 or later) to mitigate the risk. If you need further support or assistance in resolving this vulnerability, please contact DevNack.com.
See every vulnerability recorded for directus →
FAQ
Directus is an open-source headless CMS that provides a user-friendly interface for managing content and data.
The vulnerability can cause a Directus server to crash, resulting in unavailability of the service until the server is manually restarted.
Yes, this vulnerability can be exploited remotely by sending specially crafted invalid frames to a Directus server with WebSocket enabled.
Yes, the Directus development team has addressed this vulnerability in version 10.6.2. Upgrading to the latest version will fix the issue.
Yes, servers running in the directus.cloud service are also vulnerable to this issue. It is recommended to upgrade to the fixed version or contact the service provider for further assistance.
References
Related vulnerabilities
Recent vulnerabilities recorded for directus.
