CVE-2026-35441: Directus GraphQL Alias Amplification Denial of Service Vulnerability
Summary
CVE-2026-35441: Directus: GraphQL Alias Amplification Denial of Service Due to Missing Query Cost/Complexity Limits. Affects directus versions < 11.17.0. Fixed in 11.17.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Directus is an open-source data platform that provides a headless CMS and API for managing database content. It allows users to create, manage, and interact with data through a user-friendly interface and powerful GraphQL endpoints. However, the platform has a vulnerability in its GraphQL implementation that can lead to denial of service due to excessive resource consumption.
Vulnerability Detail
The vulnerability arises from Directus' GraphQL endpoints not deduplicating resolver invocations within a single request. This allows an authenticated user to exploit GraphQL aliasing, repeating expensive relational queries multiple times in a single request. As a result, the server may execute numerous complex database queries concurrently, leading to significant resource exhaustion. The lack of rate limiting exacerbates the issue, allowing any authenticated user, even those with minimal permissions, to trigger this condition, potentially degrading or crashing the service.
How To Fix
Latest published version: 12.5.0 as of 22 Oct 2026
npm install directus@12.5.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
11.17.0
This is the first release that contains the fix.
npm install directus@11.17.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as possible to avoid potential service degradation.
Conclusion
The Directus GraphQL Alias Amplification Denial of Service vulnerability (CVE-2026-35441) poses a significant risk to applications using the affected versions of Directus. It is crucial to update to version 11.17.0 or later to mitigate this risk and ensure the stability and performance of your service.
See every vulnerability recorded for directus →
FAQ
The vulnerability allows authenticated users to exploit GraphQL aliasing, leading to denial of service by executing multiple complex database queries concurrently.
Any authenticated user, including those with minimal read-only permissions, can exploit this vulnerability.
The impacts include service degradation, outages due to resource exhaustion, and the ability for low-privilege users to affect the performance of the service.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The CVSS score of this vulnerability is 6.5, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for directus.
