CVE-2019-16278

Nostromo nhttpd, a lightweight open-source HTTP server for Unix systems, is vulnerable to a directory traversal flaw (CWE-22) in its http_verify function, affecting every release through version 1.9.6. An unauthenticated remote attacker triggers it with a crafted HTTP request whose URL contains traversal sequences that http_verify fails to normalize, letting the request escape the server's webroot and reach system paths. Via that escaped path, combined with the server's request handling, the attacker achieves remote code execution with the privileges of the nhttpd process, giving a full confidentiality/integrity/availability impact (CVSS 3.1: 9.8, network vector, no privileges or user interaction required). Anyone running nostromo nhttpd 1.9.6 or earlier is affected, with internet-exposed instances at greatest risk; deployments are typically individual Unix hosts rather than large managed fleets. Exploitation is active: public proof-of-concept exploits have existed since 2019, EPSS assigns a 99% probability of exploitation in the next 30 days (100th percentile), and CISA added the bug to its Known Exploited Vulnerabilities catalog on 2024-11-07 (ransomware use: unknown).

What to do: Upgrade nostromo nhttpd to a fixed release newer than 1.9.6 (the fix shipped in 1.9.7) or install your distribution's patched package; if patching is not possible, CISA's required action is to apply vendor mitigations or discontinue use of the product. Inventory internet-facing hosts for the 'Server: Nostromo' banner, treat any unpatched exposed instance as at-risk given active exploitation, and review access logs for crafted traversal requests; ransomware association is currently unknown.