Description
countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, star-rating/images/ and dashboards/images/screenshots/ are among public image and screenshot routes using the local fs storage backend that call getStream and pipe filesystem streams to HTTP responses without an error listener. An unauthenticated request containing a URL-encoded dot can make createReadStream open a directory, emit an asynchronous EISDIR error, and terminate the Node.js process as an unhandled exception, allowing repeated requests to keep the analytics API unavailable. The affected routes also include /appimages/*, /memberimages/*, and */screenshots/*. This issue is fixed in versions 24.05.50 and 25.03.44.
Published: 2026-10-16
Score: 7.5 High
EPSS: n/a
KEV: No
Impact: Denial of Service
Action: Patch Immediately
AI Analysis

Impact

An unauthenticated attacker can trigger an unhandled stream exception by sending a request with a URL-encoded dot to public image and screenshot endpoints. The missing error handler causes Node.js to throw an asynchronous EISDIR error, terminating the process and denying service. The impact is a persistent denial of service until the server is restarted, affecting all analytics functionality.

Affected Systems

The vulnerability affects Countly’s countly-server component. Versions prior to 24.05.50 on the 24.x branch and prior to 25.03.44 on the 25.x branch are impacted. The exposed routes include /star-rating/images/, /dashboards/images/screenshots/, /appimages/*, /memberimages/*, and */screenshots/* that use local filesystem streams without error handling.

Risk and Exploitability

Affected versions score 7.5 on the CVSS scale and are not listed in CISA’s KEV catalog. The EPSS score is not available. Exploitation requires no authentication and only a crafted URL request; an attacker can repeatedly send such requests to exhaust process resources. Because the process exits on the first error, the attack is simple and highly effective when the vulnerability is present.

Generated by OpenCVE AI on October 16, 2026 at 17:55 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade countly-server to version 24.05.50 or later on the 24.x line, or to 25.03.44 or later on the 25.x line.
  • As a short‑term measure, block or remove access to the vulnerable image and screenshot endpoints (star-rating/images/, dashboards/images/screenshots/, appimages/, memberimages/, and screenshots) using a reverse proxy or firewall rules until the upgrade can be applied.
  • Verify that the application employs proper error handling for file streams, or temporarily add a global Node.js uncaughtException handler to prevent process termination during testing, but rely on the official patch for production.

Generated by OpenCVE AI on October 16, 2026 at 17:55 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 16 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 16 Oct 2026 16:15:00 +0000

Type Values Removed Values Added
Description countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, star-rating/images/ and dashboards/images/screenshots/ are among public image and screenshot routes using the local fs storage backend that call getStream and pipe filesystem streams to HTTP responses without an error listener. An unauthenticated request containing a URL-encoded dot can make createReadStream open a directory, emit an asynchronous EISDIR error, and terminate the Node.js process as an unhandled exception, allowing repeated requests to keep the analytics API unavailable. The affected routes also include /appimages/*, /memberimages/*, and */screenshots/*. This issue is fixed in versions 24.05.50 and 25.03.44.
Title countly-server: Unauthenticated Denial of Service (DoS) via Unhandled Stream Exception
Weaknesses CWE-248
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-16T16:52:38.647Z

Reserved: 2026-04-26T11:53:27.707Z

Link: CVE-2026-42270

cve-icon Vulnrichment

Updated: 2026-10-16T16:52:24.452Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-16T16:17:23.940

Modified: 2026-10-16T20:02:37.630

Link: CVE-2026-42270

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-16T18:00:16Z

Weaknesses