DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-71848: CVE-2026-71848: Algorithmic Complexity Denial of Service in Hono languageDetector Middleware

#security #cve #cybersecurity

CVE-2026-71848: Algorithmic Complexity Denial of Service in Hono languageDetector Middleware

Vulnerability ID: CVE-2026-71848
CVSS Score: 5.3
Published: 2026-08-07

An Algorithmic Complexity Denial of Service (DoS) vulnerability exists in the Hono web application framework within its languageDetector middleware. From version 4.12.0 to 4.12.33, the progressive language-tag truncation routine (normalizeLanguage) performs string operations with a quadratic time complexity O(N^2) relative to the number of hyphen-separated subtags in the user-supplied language tag. This allows an unauthenticated remote attacker to cause resource exhaustion and CPU spikes, resulting in a full denial of service of the single-threaded JavaScript runtime.

TL;DR

Unauthenticated remote attackers can cause complete Denial of Service (DoS) in Hono applications running versions 4.12.0 to 4.12.33 by sending excessively long hyphen-separated language strings in headers, cookies, or query parameters.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-407 (Inefficient Algorithmic Complexity)
  • Attack Vector: Network (AV:N)
  • CVSS Score: 5.3
  • Exploit Status: Proof of Concept (PoC) available
  • KEV Status: Not Listed
  • Impact: Denial of Service (DoS)

Affected Systems

  • Hono Framework languageDetector Middleware
  • hono: >= 4.12.0, <= 4.12.33 (Fixed in: 4.12.34)

Code Analysis

Commit: f70e2c3

Fix algorithm complexity in language middleware by reversing the prefix lookup mechanism to iterate over configuration.

Mitigation Strategies

  • Upgrade the Hono dependency to version 4.12.34 or higher to resolve the quadratic complexity loop.
  • Configure reverse proxies or web application firewalls to restrict the maximum length of the Accept-Language header.
  • Deploy custom WAF rules to block incoming headers, query parameters, or cookies containing repeating hyphenated characters.

Remediation Steps:

  1. Execute npm install hono@4.12.34 or update the lockfile using your package manager.
  2. Audit existing endpoints utilizing the languageDetector middleware.
  3. Test client endpoints with a test script verifying that long inputs are handled in O(1) time without blocking the event loop.

References

Read the full report for CVE-2026-71848 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)