CVE-2026-71848

Name of the Vulnerable Software and Affected Versions Hono versions 4.12.0 through 4.12.33

Description The languageDetector middleware is susceptible to an algorithmic complexity denial of service. This occurs when the normalizeLanguage() function processes a crafted language tag containing an excessive number of hyphen-separated subtags. The function repeatedly calls parts.slice(0, i).join('-') for every possible prefix, causing string processing to grow quadratically relative to the number of subtags. Depending on the configuration, these language values can be supplied via a query parameter, cookie, Accept-Language header, or URL path. Because the default configuration enables query string, cookie, and header detection, unauthenticated requests can trigger this behavior, leading to excessive CPU consumption and synchronous event-loop blocking that prevents other requests from being processed.

Recommendations Update to version 4.12.34.