CVE-2026-71848 in Hono
Summary
by MITRE • 08/07/2026
Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.0 to 4.12.33, the languageDetector middleware is vulnerable to algorithmic complexity denial of service when processing a crafted language tag containing a large number of hyphen separated subtags. To implement progressive language tag truncation, normalizeLanguage() repeatedly calls parts.slice(0, i).join('-') for every possible prefix, so the total amount of string processing grows quadratically with the number of subtags. Language values may come from a query parameter, cookie, Accept-Language header, or URL path, depending on the detector configuration, and the default detector order enables query string, cookie, and header detection, so applications using languageDetector() may expose this processing to unauthenticated requests. An attacker may repeatedly send requests containing long, hyphen separated language tags, causing excessive CPU consumption and preventing unrelated requests from being processed. This issue is fixed in version 4.12.34.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/07/2026
The vulnerability described in this CVE affects Hono web application framework versions 4.12.0 through 4.12.33, specifically within the languageDetector middleware component that handles internationalization processing. This represents a classic algorithmic complexity denial of service vulnerability where the implementation contains a fundamental flaw in how it processes language tags with excessive subtags. The issue stems from the normalizeLanguage() function which employs a progressive truncation approach that repeatedly calls parts.slice(0, i).join('-') for every possible prefix of the language tag, creating a quadratic time complexity pattern that scales poorly with input size. This algorithmic inefficiency directly maps to CWE-795 which categorizes excessive string processing operations that can lead to resource exhaustion attacks.
The operational impact of this vulnerability is significant as it affects applications that utilize the default language detection configuration, which includes query parameter, cookie, and Accept-Language header processing. Since these detection mechanisms are commonly used for internationalization purposes, applications using Hono's languageDetector middleware are exposed to unauthenticated denial of service attacks. An attacker can exploit this by sending repeated requests containing language tags with a large number of hyphen-separated subtags, causing the application server to consume excessive CPU resources during processing. The vulnerability affects multiple input vectors including URL query parameters, HTTP cookies, Accept-Language headers, and URL path segments, making it particularly dangerous as attackers can leverage any of these mechanisms without requiring authentication or specific privileges.
The security implications extend beyond simple resource exhaustion into broader system stability concerns that align with ATT&CK technique T1499.1 which covers resource exhaustion attacks targeting application processing. Applications using vulnerable versions of Hono become susceptible to sustained denial of service conditions where legitimate users experience degraded performance or complete service unavailability. The quadratic complexity behavior means that even modest increases in the number of subtags can cause dramatic increases in processing time, making this vulnerability particularly effective for attackers seeking to disrupt service availability. System administrators and security teams must understand that this vulnerability does not require sophisticated attack vectors but rather simple request manipulation to cause significant system impact.
Mitigation strategies should focus on both immediate remediation and defensive programming practices. The primary fix involves upgrading to Hono version 4.12.34 or later where the algorithmic complexity issue has been resolved through improved processing logic that avoids quadratic string operations. Organizations should also implement rate limiting and input validation measures at network boundaries to detect and prevent excessive language tag requests before they reach the application layer. Additionally, defensive coding practices such as implementing maximum length limits on language tag inputs, establishing CPU time limits for internationalization processing, and monitoring for unusual patterns in language detection requests can provide additional layers of protection against similar vulnerabilities in other components. The fix demonstrates proper security engineering principles by addressing the root cause rather than merely patching symptoms, aligning with industry best practices for preventing algorithmic complexity attacks that are categorized under CWE-1333 which covers inefficient algorithms and data structures that can lead to resource exhaustion.