Algorithmic Complexity Denial of Service in Hono Web Application Framework
CVE-2026-71848
What is CVE-2026-71848?
The Hono Web Application Framework is susceptible to an algorithmic complexity denial of service due to its languageDetector middleware, which mishandles crafted language tags with numerous hyphen-separated subtags. The vulnerability arises from the normalizeLanguage() function, which employs a quadratic time complexity when processing these tags as it continuously slices and joins string components. This flaw exposes applications using this framework to the risk of excessive CPU usage as an attacker can send repetitive requests with long language tags. This not only hinders the processing of legitimate requests but can also lead to overall service unavailability. The vulnerability has been addressed in version 4.12.34.
Affected Version(s)
hono >= 4.12.0, < 4.12.34