Is CVE-2026-42270 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-42270 being exploited in the wild.

How severe is CVE-2026-42270?

High severity, with a CVSS score of 7.5, published 16 October 2026.

Which products and versions are affected?

Countly-Server prior to 24.05.50 and prior to 25.03.44.

Is there a fix for CVE-2026-42270?

Yes: fixed in countly-server 24.05.50, 25.03.44. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-42270 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-42270?

Check whether you run Countly-Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42270: Countly Server unhandled stream error in image routes DoS

CVE-2026-42270 · Severity: high · CVSS 7.5 · Published 2026-10-16

Countly Server is an analytics platform that processes user interactions and displays dashboards. An unauthenticated attacker can craft requests to image and screenshot routes that crash the Node.js process, making the analytics API unavailable. By repeatedly sending these malicious requests, an attacker can maintain a denial of service condition.

Technologies: Countly-Server. Vendors: Countly.

Quick answers

Is CVE-2026-42270 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-42270 being exploited in the wild.
How severe is CVE-2026-42270?: High severity, with a CVSS score of 7.5, published 16 October 2026.
Which products and versions are affected?: Countly-Server prior to 24.05.50 and prior to 25.03.44.
Is there a fix for CVE-2026-42270?: Yes: fixed in countly-server 24.05.50, 25.03.44. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42270 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-42270?: Check whether you run Countly-Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: countly-server 24.05.50, 25.03.44

Technical details

The vulnerability exists in public image and screenshot routes (star-rating/images/, dashboards/images/screenshots/, appimages/*, memberimages/*, */screenshots/*) that stream filesystem data without handling asynchronous errors. An attacker can send URL-encoded dots in requests that cause createReadStream to open a directory instead of a file, emit an unhandled EISDIR error, and crash the Node.js process. The issue requires no authentication and can be exploited repeatedly to maintain availability disruption.

Affected products

Countly countly-server prior to 24.05.50 and prior to 25.03.44

Timeline

2026-10-16: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.