CVE-2019-16278: Nostromo nhttpd path traversal leads to remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityCVSS 9.8, CISA KEV listing, near-maximum EPSS, and public exploit references make this an urgent unauthenticated RCE.

What it is

The http_verify function in nostromo nhttpd through 1.9.6 fails to properly sanitize HTTP request paths, allowing directory traversal. Because the traversal can be chained into remote code execution, an unauthenticated network attacker can fully compromise the web server.

Impact

An attacker gains remote code execution on the host running nostromo nhttpd, which typically means full control of the web server process and its files.

Attack surface

Reachable over the network via a crafted HTTP request to the nhttpd service; the CVSS vector shows no privileges required and no user interaction.

Exploitation

CVE-2019-16278 is listed in CISA KEV with a 2024-11-07 addition date, and EPSS shows a 30-day probability of 0.99033 (99.9th percentile); multiple references are tagged Exploit.

What to do

• Upgrade nostromo nhttpd past 1.9.6 to a fixed release per vendor instructions
• If no fixed version is available, discontinue use of the product as CISA advises
• Restrict network access to the nhttpd listener to trusted hosts only
• Run the nhttpd process with least privilege and in a sandbox or container
• Monitor vendor release notes for updated guidance

Detection

• Inspect HTTP request logs for path traversal sequences such as ../ in the request URI
• Alert on unexpected child processes or shell execution spawned by the nhttpd process
• Monitor for outbound connections from the web server host that are inconsistent with normal traffic
• Review file access to paths outside the web root by the nhttpd user

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.