Live › vulnerability › CVE-2019-16278
Go to dashboardNostromo nhttpd is a small web server, and a directory traversal flaw in its http_verify() function lets remote requests reach files outside the web root. The description says this allows remote code execution on a non-chrooted server, and CISA lists it as actively exploited.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Nostromo nhttpd | vendor | – | – |
| nazgul nostromo nhttpd | vendor | < 1.9.7 | 1.9.7 |
Identify whether the nhttpd binary is running (for example ps aux | grep nhttpd) and whether it runs without chroot.
Apply the vendor mitigation or stop using Nostromo nhttpd; the sources do not name a fixed version.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Nostromo nhttpd contains a directory traversal vulnerability in the http_verify() function in a non-chrooted nhttpd server allowing for remote code execution.
CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
This page as .md · .json · in your agent: get_signal("CVE-2019-16278")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.