# CVE-2026-42270: Countly Server unhandled stream error in image routes DoS

Source: https://junglewise.ai/threats/cve-2026-42270-countly-server-is-the-server-side-part-of-countly-a-product  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-16. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-42270 · Severity: high · CVSS 7.5 · Published 2026-10-16

Countly Server is an analytics platform that processes user interactions and displays dashboards. An unauthenticated attacker can craft requests to image and screenshot routes that crash the Node.js process, making the analytics API unavailable. By repeatedly sending these malicious requests, an attacker can maintain a denial of service condition.

Technologies: [Countly-Server](https://junglewise.ai/threats/technologies/countly-server). Vendors: [Countly](https://junglewise.ai/threats/vendors/countly).

## Quick answers

**Is CVE-2026-42270 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42270 being exploited in the wild.

**How severe is CVE-2026-42270?** High severity, with a CVSS score of 7.5, published 16 October 2026.

**Which products and versions are affected?** Countly-Server prior to 24.05.50 and prior to 25.03.44.

**Is there a fix for CVE-2026-42270?** Yes: fixed in countly-server 24.05.50, 25.03.44. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-42270 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-42270?** Check whether you run Countly-Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in countly-server 24.05.50, 25.03.44

## Technical details

The vulnerability exists in public image and screenshot routes (star-rating/images/, dashboards/images/screenshots/, appimages/*, memberimages/*, */screenshots/*) that stream filesystem data without handling asynchronous errors. An attacker can send URL-encoded dots in requests that cause createReadStream to open a directory instead of a file, emit an unhandled EISDIR error, and crash the Node.js process. The issue requires no authentication and can be exploited repeatedly to maintain availability disruption.

## Affected products

- Countly countly-server prior to 24.05.50 and prior to 25.03.44

## Timeline

- 2026-10-16: disclosed

## References

- [https://github.com/Countly/countly-server/commit/72f19bc5161117fa02a224bf9f7316bf42dae58d](https://github.com/Countly/countly-server/commit/72f19bc5161117fa02a224bf9f7316bf42dae58d)
- [https://github.com/Countly/countly-server/commit/f9ad31480f94ee3ccc0f12708c8804be9c803f95](https://github.com/Countly/countly-server/commit/f9ad31480f94ee3ccc0f12708c8804be9c803f95)

## Related threats

- [Countly countly-server stored XSS in star-rating feedback upload](https://junglewise.ai/threats/cve-2026-44977-countly-server-is-the-server-side-part-of-countly-a-product)
- [Countly Server path traversal in data migration deletion](https://junglewise.ai/threats/cve-2026-42269-countly-server-is-the-server-side-part-of-countly-a-product)
- [Countly countly-server path traversal in image routes](https://junglewise.ai/threats/cve-2026-41582-countly-server-is-the-server-side-part-of-countly-a-product)