GHSA-6q22-g298-grjh: Directus: Unauthenticated Denial of Service via GraphQL Alias Amplification of Expensive Health Check Resolver
Summary
Directus had a vulnerability where attackers could send a single GraphQL query (a language for requesting data from APIs) with multiple aliases (repeated requests for the same field with different names) to the health check endpoint without authentication, causing the system to run expensive checks repeatedly and exhaust resources like database connections and storage. This could crash the service for all users.
Solution / Mitigation
A request-scoped resolver deduplication mechanism was introduced and applied across all GraphQL read resolvers. When multiple aliases in a single request invoke the same resolver with identical arguments, only the first call executes and all subsequent aliases share its result, eliminating the amplification attack.
Classification
Affected Packages
Original source: https://github.com/advisories/GHSA-6q22-g298-grjh
First tracked: April 4, 2026 at 08:00 AM
Classified by LLM (prompt v3) · confidence: 95%