Description

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.0 to 4.12.33, the languageDetector middleware is vulnerable to algorithmic complexity denial of service when processing a crafted language tag containing a large number of hyphen separated subtags. To implement progressive language tag truncation, normalizeLanguage() repeatedly calls parts.slice(0, i).join('-') for every possible prefix, so the total amount of string processing grows quadratically with the number of subtags. Language values may come from a query parameter, cookie, Accept-Language header, or URL path, depending on the detector configuration, and the default detector order enables query string, cookie, and header detection, so applications using languageDetector() may expose this processing to unauthenticated requests. An attacker may repeatedly send requests containing long, hyphen separated language tags, causing excessive CPU consumption and preventing unrelated requests from being processed. This issue is fixed in version 4.12.34.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-07T19:18:53.950Z",
  "pubdate": "2026-08-07T19:18:53.950Z",
  "executiveSummary": "A denial of service vulnerability exists in the Hono web application framework's languageDetector middleware, specifically affecting versions 4.12.0 through 4.12.33. The vulnerability stems from algorithmic complexity issues during the processing of maliciously crafted language tags containing an excessive number of hyphen-separated subtags.\nThe vulnerability allows an unauthenticated remote attacker to trigger excessive CPU consumption by sending repeatedly crafted requests containing extremely long language tags via supported input vectors such as query parameters, cookies, the Accept-Language header, or URL paths, depending on the active detector configuration.\nBecause the default detector order enables query string, cookie, and header detection, applications utilizing the languageDetector() middleware without customization are broadly exposed to unauthenticated exploitation. The resulting high CPU utilization leads to service degradation and resource exhaustion, preventing the application from processing legitimate, unrelated requests.\nMitigation requires upgrading the Hono framework to version 4.12.34 or later, where the algorithmic flaw in language tag normalization has been formally resolved.",
  "technicalDetails": "The root cause of the vulnerability resides within the normalizeLanguage() function of the languageDetector middleware in the Hono framework. To implement progressive language tag truncation, the function repeatedly executes parts.slice(0, i).join('-') across every possible prefix of the provided language tag.\nWhen processing a language tag constructed with a massive number of hyphen-separated subtags, the string manipulation and array slicing operations scale quadratically, resulting in severe performance degradation and excessive CPU utilization.\nLanguage values processed by the vulnerable component originate from unauthenticated client-supplied vectors, including query parameters, HTTP cookies, the Accept-Language header, and URL paths, depending entirely on the active detector configuration.\nIn standard deployments utilizing default detector orders—which inherently enable query string, cookie, and header detection vectors—an attacker does not require any prior authentication or privileged access to interact with the vulnerable endpoint.\nThe attack flow proceeds as follows: First, the attacker crafts a malicious HTTP request containing an abnormally long, hyphen-separated language tag supplied via an exposed parameter such as a query string or the Accept-Language header. Second, the Hono application routes the request to the languageDetector middleware. Third, the normalizeLanguage() function processes the oversized tag, executing repetitive slice and join operations that consume disproportionate CPU cycles. Fourth, by continuously dispatching these malicious payloads concurrently or in rapid succession, the attacker monopolizes the event loop or worker threads, exhausting system resources and causing a denial of service for all concurrent, legitimate application traffic."
}