# CVE-2019-16278: Nostromo nhttpd Directory Traversal Vulnerability

Source: https://junglewise.ai/threats/cve-2019-16278-nostromo-nhttpd-directory-traversal-vulnerability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-11-07. Updated: 2026-05-09  
License: CC BY 4.0 with a link back

CVE-2019-16278 · Severity: critical · CVSS 9.8 · Exploited in the wild · Published 2024-11-07

A directory traversal vulnerability exists in the http_verify() function of Nostromo nhttpd through version 1.9.6. An attacker can exploit this via a crafted HTTP request to bypass directory restrictions and achieve remote code execution on non-chrooted servers.

## Quick answers

**Is CVE-2019-16278 exploited in the wild?** Yes. CVE-2019-16278 is known to be exploited in the wild, first recorded on 7 November 2024. Treat it as urgent.

**How severe is CVE-2019-16278?** Critical severity, with a CVSS score of 9.8, published 7 November 2024.

**Which products and versions are affected?** Nazgul nhttpd up to 1.9.6.

**Is there a fix for CVE-2019-16278?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2019-16278 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2019-16278?** Check whether you run Nostromo NHTTPD. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Nazgul nhttpd up to 1.9.6

## Timeline

- 2019-10-31: disclosed: Initial CVE modification date recorded by MITRE
- 2024-11-07: kev added: Added to CISA Known Exploited Vulnerabilities Catalog
- 2024-11-07: advisory: NVD publication date