Nostromo nhttpd Directory Traversal (CVE-2019-16278)

Historical catalog analysis: CISA added this entry on November 07, 2024. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.

What the vulnerability is

CVE-2019-16278 is a directory traversal vulnerability (CWE-22) identified in the Nostromo nhttpd web server. The flaw resides specifically within the http_verify() function. If exploited, this vulnerability could allow an attacker to achieve remote code execution.

Exposure and applicability

This vulnerability does not affect all deployments of nhttpd. It is applicable only to servers that are running in a non-chrooted configuration. Organizations utilizing chroot jails for their nhttpd instances may have a different risk profile, as the directory traversal would be constrained by the jail’s root directory.

Remediation priorities

Based on the reported vulnerability, our analysis suggests the following prioritization for infrastructure owners:

1. Asset Identification: Identify all active instances of Nostromo nhttpd and determine if they are operating in a non-chrooted environment. Assets lacking chroot isolation should be prioritized for immediate action.
2. Mitigation Application: Apply vendor-supplied mitigations as specified in the official instructions.
3. Decommissioning: In cases where vendor mitigations are unavailable or cannot be applied to the existing environment, the product should be discontinued and replaced with a supported alternative.

How to validate remediation

Verification of this fix requires more than a version check, as the vulnerability’s impact is tied to the server’s operational configuration (chrooted vs. non-chrooted).

• Configuration Audit: Defenders should verify the system configuration to confirm whether the nhttpd process is successfully confined to a chroot jail.
• Mitigation Verification: If a patch or mitigation was applied, validation should involve confirming that the http_verify() function no longer permits traversal outside of the intended web root.

Limits and open questions

It remains unknown whether this vulnerability has been utilized in known ransomware campaigns. Furthermore, while applying vendor mitigations reduces exposure, residual risk may persist if the underlying operating system lacks secondary layers of defense to prevent code execution following a successful traversal. The effectiveness of the mitigation is dependent on the accurate implementation of vendor instructions.

Source and editorial note

CVE-2019-16278: Nostromo nhttpd Directory Traversal Vulnerability · Source date: November 07, 2024 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Archive date: November 10, 2024. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: November 05, 2026 at 00:18 UTC.

Request a Vulnerability Assessment