High severity · published Oct 16, 2026
CVE-2026-42270
countly-server: Unauthenticated Denial of Service (DoS) via Unhandled Stream Exception
7.5
CVSS
0.5%
EPSS
No
On KEV
Description
countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, star-rating/images/ and dashboards/images/screenshots/ are among public image and screenshot routes using the local fs storage backend that call getStream and pipe filesystem streams to HTTP responses without an error listener. An unauthenticated request containing a URL-encoded dot can make createReadStream open a directory, emit an asynchronous EISDIR error, and terminate the Node.js process as an unhandled exception, allowing repeated requests to keep the analytics API unavailable. The affected routes also include /appimages/*, /memberimages/*, and */screenshots/*. This issue is fixed in versions 24.05.50 and 25.03.44.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 45% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
countly-server · Countly
< 24.05.50; >= 25.03, < 25.03.44 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-42270
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-42270
github.com
https://github.com/Countly/countly-server/commit/72f19bc5161117fa02a224bf9f7316bf42dae58d
github.com
https://github.com/Countly/countly-server/commit/f9ad31480f94ee3ccc0f12708c8804be9c803f95
github.com
https://github.com/Countly/countly-server/releases/tag/24.05.50
github.com
https://github.com/Countly/countly-server/releases/tag/25.03.44
github.com
https://github.com/Countly/countly-server/security/advisories/GHSA-86cv-qwp9-jwp3
More from countly-server
9.0
CVE-2026-44977
countly-server: Stored XSS in feedback upload enables app-admin to compromise global admin session context
9.0
CVE-2021-32852
countly-server vulnerable to Cross-site Scripting
8.1
CVE-2026-42269
countly-server: Path Traversal in delete_import Endpoint Allows Arbitrary File and Directory Deletion
8.1
CVE-2022-29174
Predictable password reset token may lead to account takeover in countly-server
7.5
CVE-2026-41582
countly-server: Unauthenticated Path Traversal via Public Image and Screenshot Routes Leads to Read Internal Files