The Hono web application framework's languageDetector middleware suffers from an inefficient algorithmic complexity vulnerability (CWE-407) in versions 4.12.0 to 4.12.33. The normalizeLanguage() function implements progressive language tag truncation by repeatedly calling parts.slice(0, i).join('-') for every prefix, resulting in quadratic string processing time relative to the number of subtags. Since language values can be sourced from query parameters, cookies, Accept-Language headers, or URL paths, an attacker can send crafted requests with long hyphen-separated language tags to cause excessive CPU consumption, leading to denial of service. This vulnerability is addressed in version 4.12.34.

An unauthenticated attacker can cause a denial of service by sending requests with specially crafted language tags containing many hyphen-separated subtags. This leads to excessive CPU consumption in the languageDetector middleware, potentially preventing the application from processing legitimate requests. There is no impact on confidentiality or integrity.

Upgrade Hono to version 4.12.34 or later, where this vulnerability is fixed. Until then, consider limiting the length or complexity of language tag inputs if possible. Patch status is not explicitly confirmed beyond the stated fixed version; check the vendor advisory for the latest remediation guidance.