Vulnerabilities

Vulnerability · GHSA-g293-vf99-xv36

Unthrottled system GraphQL resolvers allow anonymous DoS via alias amplification

Published Aug 5, 2026 · catalog updated Aug 5, 2026 · Unthrottled system GraphQL resolvers

Last checked Nov 1, 2026. A connected source was read within the last 7 days.

Open the advisory

Exploitation likelihood is not on this record for GHSA-g293-vf99-xv36. A missing EPSS score is not a low risk. Compare Unthrottled system GraphQL resolvers with the linked advisory before you change production.

Severity

High7.5

Known exploitation

Not in CISA/VulnCheck KEV

EPSS

Awaiting synchronization with FIRST

Remediation

Version ranges on file

Affected products

npm directus

## Summary A prior advisory (GHSA-6q22-g298-grjh) addressed GraphQL alias-amplification on by wrapping the resolvers in with a deduplication layer. The companion resolver file was not covered. Several anonymously reachable, expensive resolvers remain un-deduplicated, so a single anonymous request containing many aliased calls is multiplied into many server-side operations. This enables an unauthenticated attacker, in a single HTTP request, to: - **Account-lockout DoS**: flip any account with a guessable email to a suspended state by exceeding the per-account failed-login threshold. - **Mail flooding**: trigger an arbitrary number of password-reset emails to any address, exhausting SMTP quota and harassing the recipient. - **CPU exhaustion**: force many argon2id hashing operations per request, amplified further by parallel connections. - **Accelerated credential probing**: test up to the lockout threshold of credentials against an account in a single request. ## Details The affected resolvers in are anonymously reachable and each carry meaningful server-side cost (argon2id hashing, user lookups, or SMTP sends): , , , and . Because GraphQL aliasing lets one document invoke the same field many times, and these resolvers are not deduplicated, one HTTP request expands into N operations. The HTTP-level rate limiter counts requests, not resolver invocations, so the amplification bypasses it even when the limiter is enabled. Default configuration increases exposure rather than mitigating it. The HTTP and email rate limiters are disabled by default, the default per-account failed-login threshold is low enough to be crossed within a single amplified request, and GraphQL introspection is enabled by default, making the schema anonymously discoverable. ## Impact Any Directus deployment with reachable by the attacker is affected. An unauthenticated attacker can suspend arbitrary accounts (including privileged ones with guessable emails), flood arbitrary recipients with password-r