EUVD-2026-102916Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend request to public image route with URL-encoded dot
-
ExploitcreateReadStream opens directory, emits async EISDIR
-
ExecutionUnhandled stream error crashes Node.js process
-
ImpactRepeat to sustain analytics API outage
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Exception handling completeness
|
| Exploitation Conditions | Exploitation requires that the affected public image/screenshot routes (star-rating/images/, dashboards/images/screenshots/, /appimages/*, /memberimages/*, and */screenshots/*) be served by Countly's local fs storage backend, which calls getStream/createReadStream and pipes filesystem streams to HTTP responses without an error listener. No authentication or user interaction is needed (PR:N/UI:N) and the trigger is a single crafted path containing a URL-encoded dot that causes createReadStream to open a directory. The primary limiting factor is the storage configuration: deployments not using the local fs backend for these routes are not affected; impact is confined to availability of the analytics API. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) is internally consistent with the description and with CWE-248 (uncaught exception): a single unauthenticated network request of low complexity crashes the Node.js process, yielding a pure availability impact (C:N/I:N) and no scope change. No EPSS score was supplied, the CVE is not listed in CISA KEV, and no public exploit code is referenced, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The practical risk is moderate-to-high for affected operators because the trigger is trivial (a URL-encoded dot in a public image path) and repeatable to sustain an outage, but it is bounded: the vulnerable routes must be served by the local fs storage backend, and the impact is denial of service only, not data compromise. Note a tag discrepancy: the input tags 'Information Disclosure', yet the CVSS vector (C:N), CWE-248, and the description all describe a process-crash denial of service, not information disclosure - treat the availability framing as authoritative. |
| Exploit ScenarioDerived | An unauthenticated attacker sends an HTTP request to a public image route (e.g. /appimages/*, star-rating/images/, or */screenshots/*) containing a URL-encoded dot so that createReadStream resolves to a directory rather than a file. The resulting asynchronous EISDIR error has no stream error listener, so it propagates as an unhandled exception and terminates the Node.js process. Repeating the request keeps the analytics API offline; no public proof-of-concept is referenced, but the trigger is trivial to reproduce from the description and patch diff. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 16, 2026
Unauthenticated denial of service in Countly Server prior to 24.05.50 and 25.03.44 lets any remote network attacker crash the Node.js process that serves the analytics API by requesting a public image or screenshot route (star-rating/images/, dashboards/images/screenshots/, /appimages/*, /memberimages/*, and other */screenshots/* paths) whose path contains a URL-encoded dot. On deployments using Countly's local filesystem storage backend, that crafted path makes createReadStream open a directory instead of a file; the resulting asynchronous EISDIR error has no listener on the piped stream, so it surfaces as an unhandled exception and terminates the server process. Repeated requests keep the API unavailable; the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) confirms a low-complexity, unauthenticated, availability-only impact with no confidentiality or integrity effect, and no public exploit code or CISA KEV entry was identified at time of analysis.
RemediationAI
Upgrade to a fixed release: Countly Server 24.05.50 (24.05.x line) or 25.03.44 (25.03.x line), available at https://github.com/Countly/countly-server/releases/tag/24.05.50 and https://github.com/Countly/countly-server/releases/tag/25.03.44, per advisory GHSA-86cv-qwp9-jwp3. If an immediate upgrade is not possible, the most reliable compensating control is to stop using the local filesystem backend for these routes and switch image/screenshot serving to a non-local storage backend (e.g. S3/GridFS), which bypasses the vulnerable createReadStream code entirely - the trade-off is that stored assets must be migrated or re-uploaded. Alternatively, place a reverse proxy in front of the exposed routes (star-rating/images/, dashboards/images/screenshots/, /appimages/*, /memberimages/*, */screenshots/*) and reject or decode-and-normalize any request whose path contains %2e or resolves to a directory, accepting the risk of blocking legitimate filenames that contain encoded dots. A process supervisor (systemd/pm2) that restarts Countly on crash reduces downtime but does not prevent the outage, since the attacker's request can be repeated. The upstream fixes are the commits 72f19bc5161117fa02a224bf9f7316bf42dae58d (frontend/express/app.js stream error handlers) and f9ad31480f94ee3ccc0f12708c8804be9c803f95, which add stream.on('error') handling; these correspond to the released 24.05.50 and 25.03.44 builds.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Countly is an open-source product analytics platform whose server component ships an Express-based frontend (frontend/express/app.js) plus feature plugins such as star-rating and dashboards. The vulnerable code path is the mounted static file handler: when the configured storage backend is 'local fs', these routes call getStream and then pipe a Node.js fs.createReadStream filesystem stream directly into the HTTP response using stream.pipe(res). Because no 'error' event handler is attached to the stream, any asynchronous stream error becomes an uncaught exception. The specific trigger abuses path normalization: a request path containing a URL-encoded dot (%2e) survives Naive URL decoding long enough that the resolved path names a directory, and createReadStream on a directory emits an EISDIR error asynchronously, after the function has already returned - the classic precondition for CWE-248 (Uncaught Exception). The Node.js runtime then prints the exception and exits, taking the whole analytics API down until the process is restarted. The upstream fix adds stream.on('error', ...) handlers that log the error and either fall back to a default icon (frontend/express/app.js, star-rating) or return res.send(false) / res.end() depending on whether headers were already sent (dashboards plugin), turning the fatal exception into a graceful 4xx/placeholder response. The security posture depends on storage configuration: instances that use a non-local backend for these routes never execute the vulnerable createReadStream path and are not affected.
Know when Node.js gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Unauthenticated single-request path (AV:N/AC:L/PR:N/UI:N) crashes the process for a pure availability impact (A:H), with no confidentiality or integrity effect and no scope change.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, star-rating/images/ and dashboards/images/screenshots/ are among public image and screenshot routes using the local fs storage backend that call getStream and pipe filesystem streams to HTTP responses without an error listener. An unauthenticated request containing a URL-encoded dot can make createReadStream open a directory, emit an asynchronous EISDIR error, and terminate the Node.js process as an unhandled exception, allowing repeated requests to keep the analytics API unavailable. The affected routes also include /appimages/*, /memberimages/*, and */screenshots/*. This issue is fixed in versions 24.05.50 and 25.03.44.
Technical POC Analysis
CWE-248 (Uncaught Exception), with the advisory also tagging CWE-400 (Uncontrolled Resource Consumption).
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
Countly Server, the analytics platform behind product, marketing, and customer-facing dashboards, can be forced offline by any unauthenticated party able to reach the network - no credentials, no user interaction, and no special access required. Because the flaw crashes the API process repeatedly rather than exposing data, the exposure is one of availability and business continuity: reporting, dashboards, and downstream analytics integrations go dark for as long as an attacker keeps sending requests. Leadership should treat this as an operational resilience issue for teams that depend on Countly for decision-making and customer reporting, not as a data-breach event.
No vendor-released patch identified at time of analysis; interim mitigations include edge rate limiting and WAF/reverse-proxy rules blocking requests to the listed public image, screenshot, and app-image routes whose paths contain a URL-encoded dot; migrating deployments off Countly's local filesystem storage backend to object storage, which removes the affected code path; process supervision with automatic restart and health-check monitoring to reduce outage duration and trigger response; and network-level restrictions limiting which clients can reach the analytics API.
Threat Intelligence Overview
NVD
CVE.org
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Remote code execution in n8n's workflow expression evaluation system allows an authenticated user with workflow creation
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
Exploit-DB