Vulnerabilities

Vulnerability · GHSA-gwvv-rr68-cmv6

Unauthenticated persistent Denial of Service via prototype pollution in the query parameter

Published Aug 20, 2026 · catalog updated Aug 20, 2026 · Unauthenticated persistent Denial of

Last checked Nov 1, 2026. A connected source was read within the last 7 days.

Open the advisory

Exploitation likelihood is not on this record for GHSA-gwvv-rr68-cmv6. A missing EPSS score is not a low risk. Compare Unauthenticated persistent Denial of with the linked advisory before you change production.

Severity

High7.5

Known exploitation

Not in CISA/VulnCheck KEV

EPSS

Awaiting synchronization with FIRST

Remediation

Version ranges on file

Affected products

npm directus

## Summary A single unauthenticated request to the Directus items API can crash the Node.js process and keep it down. The query parameter, when supplied as a JSON string, is parsed and its keys are used to build an object path that is written with a prototype-walking setter, with no validation of the key names. A crafted payload uses inherited built-in method names (rather than , , or ) to corrupt a shared JavaScript built-in. Directus later invokes that built-in in its logging path, which now throws outside any request handler and terminates the server. The instance stays down until it is restarted, and the same request kills it again. ## Details The sanitization runs inside the global query-sanitization middleware, which executes before any per-collection permission check. A missing token is admitted as the role without throwing, so the vulnerable code path is reached by a completely unauthenticated request, and even for a collection that does not exist. When is provided as a JSON string it is parsed and walked key-by-key into an object path, which is then written with a setter that traverses and reuses inherited properties. Because the setter follows the prototype chain, a path built from attacker-controlled keys named after inherited built-in methods reads the corresponding function on the prototype and overwrites one of its properties. This corrupts a shared built-in that is used pervasively across Node.js and Directus's logging stack. The next time that built-in is invoked (on response finalization, outside the request try/catch), it throws an unhandled error and the process exits. Notably: - The write never touches , , or , so blocklists that only cover those three keys do not apply. Several other built-in names are reachable in the same way. - Query-string bracket notation is not a viable delivery vector because the underlying query parser strips prototype-named bracket keys by default. Supplying as an opaque JSON string bypasses that protection, because the