diff --git a/src/routes/profile.js b/src/routes/profile.js
index dd9076a9d..0f2a3a57d 100644
--- a/src/routes/profile.js
+++ b/src/routes/profile.js
@@ -130,6 +130,7 @@ async function getAvatarById(req, res, next) {
 
     const [userError, user] = await safe(users.get(req.params.identifier));
     if (userError) return next(BoxError.toHttpError(userError));
+    if (!user) return next(new HttpError(404, 'no avatar'));
 
     const [avatarError, avatar] = await safe(users.getAvatar(user));
     if (avatarError) return next(BoxError.toHttpError(avatarError));