CVE-2026-42270
7.5HighPublished 16 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on availability
- Weakness
- CWE-248
Impact
Unauthenticated remote attackers can crash the Node.js process and trigger a denial of service across the analytics API. All they need is network access to send crafted HTTP requests with URL-encoded dots to public image endpoints.
Root cause
Filesystem streams are piped to HTTP responses without an error handler, causing unhandled asynchronous EISDIR exceptions when directory paths are requested.
Affected systems
Countly countly-server prior to versions 24.05.50 and 25.03.44 using the local fs storage backend.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Fix & remediation
Upgrade countly-server to version 24.05.50, 25.03.44, or later. If upgrading immediately is not possible, block requests containing URL-encoded dots or restrict access at your reverse proxy/WAF to the affected routes: star-rating/images/, dashboards/images/screenshots/, /appimages/*, /memberimages/*, and */screenshots/*.
$ git fetch --tags && git checkout 25.03.44AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, star-rating/images/ and dashboards/images/screenshots/ are among public image and screenshot routes using the local fs storage backend that call getStream and pipe filesystem streams to HTTP responses without an error listener. An unauthenticated request containing a URL-encoded dot can make createReadStream open a directory, emit an asynchronous EISDIR error, and terminate the Node.js process as an unhandled exception, allowing repeated requests to keep the analytics API unavailable. The affected routes also include /appimages/*, /memberimages/*, and */screenshots/*. This issue is fixed in versions 24.05.50 and 25.03.44.
References
- https://github.com/Countly/countly-server/commit/72f19bc5161117fa02a224bf9f7316bf42dae58d
- https://github.com/Countly/countly-server/commit/f9ad31480f94ee3ccc0f12708c8804be9c803f95
- https://github.com/Countly/countly-server/releases/tag/24.05.50
- https://github.com/Countly/countly-server/releases/tag/25.03.44
- https://github.com/Countly/countly-server/security/advisories/GHSA-86cv-qwp9-jwp3
- https://github.com/Countly/countly-server/security/advisories/GHSA-86cv-qwp9-jwp3