GHSA-j8xj-7jff-46mx Directus's S3 assets become unavailable after a burst of malformed transformations

• npm @directus/storage-driver-s3: >= 9.22.0, < 12.0.1 → fixed in 12.0.1 • npm directus: >= 9.22.0, < 11.5.0 → fixed in 11.5.0

Summary When making many malformed transformation requests at once, at some point, all assets are being served as 403. Details When I was investigating this issue, I have found that after a burst of malformed asset transformation requests, the amount of `sockets` held on Agent on NodeHttpHandler was always equal to `STORAGE_CLOUD_MAX_SOCKETS` making it impossible to have new connections causing assets to be inaccessible. After looking into this issue on AWS SDK I found that if the stream is requested, it needs to be consumed otherwise will hang forever. And as can be seen here the stream is not consumed, because `sharp` will throw an error on the invalid arguments. For example `?height=xyz` The timeouts set here had no noticeable effect on tests made. PoC This can be easily reproduced with the following steps: • setup AWS S3 storage • set STORAGE_CLOUD_MAX_SOCKETS: "50" (this value is lower than default for easier reproduction) • upload a file to your project • run this file (Replace the the file ID with the one you just uploaded): ```ts import axios from "axios"; async function start() { Array.from({ length: 400 }, (_, i) => { axios .get( "http://localhost:8055/assets/e536aa35-3a81-4fa9-b856-3780584d38d8?width=100&height=XYZ" ) .then(() => console.log("✅")) .catch((e) => console.log("⛔", e.response?.status || e.code || e.message) ); }); } start(); ``` Here's an example: https://github.com/user-attachments/assets/7f5a6f51-1c51-4d4d-aa4f-c4953e91714c Impact This causes denial of assets for all policies of Directus, including Admin and Public.