CVE-2026-71848: CWE-407: Inefficient Algorithmic Complexity in honojs hono
Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.0 to 4.12.33, the languageDetector middleware is vulnerable to algorithmic complexity denial of service when processing a crafted language tag containing a large number of hyphen separated subtags. To implement progressive language tag truncation, normalizeLanguage() repeatedly calls parts.slice(0, i).join('-') for every possible prefix, so the total amount of string processing grows quadratically with the number of subtags. Language values may come from a query parameter, cookie, Accept-Language header, or URL path, depending on the detector configuration, and the default detector order enables query string, cookie, and header detection, so applications using languageDetector() may expose this processing to unauthenticated requests. An attacker may repeatedly send requests containing long, hyphen separated language tags, causing excessive CPU consumption and preventing unrelated requests from being processed. This issue is fixed in version 4.12.34.
AI Analysis
Technical Summary
The Hono web application framework's languageDetector middleware suffers from an inefficient algorithmic complexity vulnerability (CWE-407) in versions 4.12.0 to 4.12.33. The normalizeLanguage() function implements progressive language tag truncation by repeatedly calling parts.slice(0, i).join('-') for every prefix, resulting in quadratic string processing time relative to the number of subtags. Since language values can be sourced from query parameters, cookies, Accept-Language headers, or URL paths, an attacker can send crafted requests with long hyphen-separated language tags to cause excessive CPU consumption, leading to denial of service. This vulnerability is addressed in version 4.12.34.
Potential Impact
An unauthenticated attacker can cause a denial of service by sending requests with specially crafted language tags containing many hyphen-separated subtags. This leads to excessive CPU consumption in the languageDetector middleware, potentially preventing the application from processing legitimate requests. There is no impact on confidentiality or integrity.
Mitigation Recommendations
Upgrade Hono to version 4.12.34 or later, where this vulnerability is fixed. Until then, consider limiting the length or complexity of language tag inputs if possible. Patch status is not explicitly confirmed beyond the stated fixed version; check the vendor advisory for the latest remediation guidance.
CVE-2026-71848: CWE-407: Inefficient Algorithmic Complexity in honojs hono
Description
Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.0 to 4.12.33, the languageDetector middleware is vulnerable to algorithmic complexity denial of service when processing a crafted language tag containing a large number of hyphen separated subtags. To implement progressive language tag truncation, normalizeLanguage() repeatedly calls parts.slice(0, i).join('-') for every possible prefix, so the total amount of string processing grows quadratically with the number of subtags. Language values may come from a query parameter, cookie, Accept-Language header, or URL path, depending on the detector configuration, and the default detector order enables query string, cookie, and header detection, so applications using languageDetector() may expose this processing to unauthenticated requests. An attacker may repeatedly send requests containing long, hyphen separated language tags, causing excessive CPU consumption and preventing unrelated requests from being processed. This issue is fixed in version 4.12.34.
CVSS v3.1
Score 5.3medium
Affected software
honojs
hono
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Hono web application framework's languageDetector middleware suffers from an inefficient algorithmic complexity vulnerability (CWE-407) in versions 4.12.0 to 4.12.33. The normalizeLanguage() function implements progressive language tag truncation by repeatedly calling parts.slice(0, i).join('-') for every prefix, resulting in quadratic string processing time relative to the number of subtags. Since language values can be sourced from query parameters, cookies, Accept-Language headers, or URL paths, an attacker can send crafted requests with long hyphen-separated language tags to cause excessive CPU consumption, leading to denial of service. This vulnerability is addressed in version 4.12.34.
Potential Impact
An unauthenticated attacker can cause a denial of service by sending requests with specially crafted language tags containing many hyphen-separated subtags. This leads to excessive CPU consumption in the languageDetector middleware, potentially preventing the application from processing legitimate requests. There is no impact on confidentiality or integrity.
Mitigation Recommendations
Upgrade Hono to version 4.12.34 or later, where this vulnerability is fixed. Until then, consider limiting the length or complexity of language tag inputs if possible. Patch status is not explicitly confirmed beyond the stated fixed version; check the vendor advisory for the latest remediation guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-08-07T18:26:53.523Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a762a7bbf8831d539f90bf9
Added to database: 08/07/2026, 18:56:59 UTC
Last enriched: 08/07/2026, 19:47:18 UTC
Last updated: 09/21/2026, 22:01:37 UTC
Views: 59
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.