{"uuid": "a7ee3e07-8b3b-46d5-91e7-b585b68506fc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-54fx-42gc-7vw4", "type": "seen", "source": "https://gist.github.com/alon710/b3f3e72bf33c744afdd90509c65dceb1", "content": "# CVE-2026-71848: CVE-2026-71848: Algorithmic Complexity Denial of Service in Hono languageDetector Middleware\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-08-07\n> **Full Report:** https://cvereports.com/reports/CVE-2026-71848\n\n## Summary\nAn Algorithmic Complexity Denial of Service (DoS) vulnerability exists in the Hono web application framework within its languageDetector middleware. From version 4.12.0 to 4.12.33, the progressive language-tag truncation routine (normalizeLanguage) performs string operations with a quadratic time complexity O(N^2) relative to the number of hyphen-separated subtags in the user-supplied language tag. This allows an unauthenticated remote attacker to cause resource exhaustion and CPU spikes, resulting in a full denial of service of the single-threaded JavaScript runtime.\n\n## TL;DR\nUnauthenticated remote attackers can cause complete Denial of Service (DoS) in Hono applications running versions 4.12.0 to 4.12.33 by sending excessively long hyphen-separated language strings in headers, cookies, or query parameters.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-407 (Inefficient Algorithmic Complexity)\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 5.3\n- **Exploit Status**: Proof of Concept (PoC) available\n- **KEV Status**: Not Listed\n- **Impact**: Denial of Service (DoS)\n\n## Affected Systems\n\n- Hono Framework languageDetector Middleware\n- **hono**: >= 4.12.0, <= 4.12.33 (Fixed in: `4.12.34`)\n\n## Mitigation\n\n- Upgrade the Hono dependency to version 4.12.34 or higher to resolve the quadratic complexity loop.\n- Configure reverse proxies or web application firewalls to restrict the maximum length of the Accept-Language header.\n- Deploy custom WAF rules to block incoming headers, query parameters, or cookies containing repeating hyphenated characters.\n\n**Remediation Steps:**\n1. Execute `npm install hono@4.12.34` or update the lockfile using your package manager.\n2. Audit existing endpoints utilizing the languageDetector middleware.\n3. Test client endpoints with a test script verifying that long inputs are handled in O(1) time without blocking the event loop.\n\n## References\n\n- [GitHub Security Advisory GHSA-54fx-42gc-7vw4](https://github.com/honojs/hono/security/advisories/GHSA-54fx-42gc-7vw4)\n- [Fix Commit f70e2c316](https://github.com/honojs/hono/commit/f70e2c31684387b3231cc38512a31df6ca76a1c7)\n- [Hono v4.12.34 Release Notes](https://github.com/honojs/hono/releases/tag/v4.12.34)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-71848) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-08T00:34:16.828224Z"}