CVE-2019-16278

What is Nostromo nhttpd?

Nostromo (nhttpd) is a small, lightweight open-source web server intended as a fast alternative to larger servers like Apache for simple hosting needs. Its minimal footprint made it popular for embedded systems, IoT devices, and low-resource hosting scenarios, but it also received far less security scrutiny and fewer updates than mainstream web servers.

Overview

CVE-2019-16278 is a critical directory traversal vulnerability in Nostromo nhttpd's http_verify() function. On servers not running in a chrooted environment, an unauthenticated remote attacker can send a crafted HTTP request that escapes the web root, ultimately enabling remote code execution on the underlying host. CVSS 3.1 base score 9.8 (Critical).

Technical Details

This is CWE-22 (Path Traversal). The http_verify() function fails to properly sanitize ../-style sequences (and encoded variants) in requested paths, allowing an attacker to reference files and directories outside the intended web root. Combined with the ability to reach executable content or system files outside the sandboxed directory structure, this traversal can be escalated into full remote code execution on servers that are not running nhttpd inside a chroot jail, which significantly limits the practical damage.

Discovery

The vulnerability was documented in the Nostromo project's changelog following its identification; given the project's low profile, public details on formal researcher attribution are limited.

Exploitation Context

CISA added CVE-2019-16278 to the KEV catalog in November 2024, five years after initial disclosure — a reminder that vulnerabilities in niche, lightly maintained software can remain exploitable and relevant for years after publication, particularly on embedded and IoT devices that are rarely updated. CISA's required action calls for applying mitigations or discontinuing use where mitigations are unavailable, reflecting the project's limited ongoing maintenance.

Remediation

1. Upgrade to a patched version of Nostromo nhttpd if one is available for your platform; check the project's changelog for the fix addressing http_verify().
2. Run nhttpd inside a chroot jail if continued use is necessary — this significantly limits the impact of the directory traversal even if unpatched.
3. Where patching or chrooting is not feasible, replace Nostromo with an actively maintained web server.
4. Restrict network exposure of any nhttpd instance to trusted networks only; do not expose it directly to the internet.
5. Audit embedded/IoT devices in your environment for bundled copies of nhttpd, as it is sometimes embedded inside other products without obvious labeling.