CVE-2026-71848: Hono Framework DoS Vulnerability

CVE-2026-71848 Overview

CVE-2026-71848 is an algorithmic complexity denial of service vulnerability in the Hono web application framework. The flaw affects the languageDetector middleware in versions 4.12.0 through 4.12.33. The normalizeLanguage() function performs progressive language tag truncation by repeatedly calling parts.slice(0, i).join('-') for every prefix of a hyphen-separated language tag. This produces quadratic string processing relative to the number of subtags. Attackers can send crafted language values through query parameters, cookies, Accept-Language headers, or URL paths to trigger excessive CPU consumption. The issue is resolved in version 4.12.34.

Critical Impact
Unauthenticated remote attackers can exhaust CPU resources on Hono applications using languageDetector(), preventing unrelated requests from being processed.

Affected Products

Hono framework versions 4.12.0 through 4.12.33
Applications using the languageDetector middleware
Deployments accepting language tags via query string, cookie, or Accept-Language header (default detector order)

Discovery Timeline

2026-08-07 - CVE-2026-71848 published to NVD
2026-08-08 - Last updated in NVD database

Technical Details for CVE-2026-71848

Vulnerability Analysis

The vulnerability is classified as an algorithmic complexity attack [CWE-407]. The languageDetector middleware normalizes user-supplied language tags to match against a list of supported languages using RFC 4647 Lookup semantics. The original implementation split the input tag on hyphens and iterated backward through every possible prefix, calling parts.slice(0, i).join('-') on each iteration.

Each slice and join operation is linear in the number of subtags. Combined with the outer loop, this yields O(n²) work per request, where n is the count of hyphen-separated subtags. A crafted tag containing thousands of subtags forces the Node.js event loop to spend substantial CPU on a single request, blocking other pending requests on the same worker.

Root Cause

The root cause is inefficient string construction inside the progressive truncation loop in src/middleware/language/language.ts. Rather than iterating over the supported language list once to find the longest prefix match, the original code rebuilt candidate strings from parts on every iteration. Attacker-controlled input length directly drives the computational cost.

Attack Vector

An unauthenticated attacker sends HTTP requests containing a long, hyphen-separated language tag such as en-us-x-a-a-a-...-a in the Accept-Language header, a cookie, a query parameter, or a URL path segment, depending on detector configuration. The default detector order enables header, cookie, and query string sources, so no authentication or user interaction is required. Repeated requests consume CPU cycles and degrade service availability.

typescript

     }
 
     // Progressive truncation (RFC 4647 Lookup)
-    const parts = compLang.split('-')
-    for (let i = parts.length - 1; i > 0; i--) {
-      const candidate = parts.slice(0, i).join('-')
-      const prefixIndex = compSupported.indexOf(candidate)
-      if (prefixIndex !== -1) {
-        return options.supportedLanguages[prefixIndex]
+    let longestMatchIndex = -1
+    let longestMatchLength = -1
+    for (let i = 0; i < compSupported.length; i++) {
+      const candidate = compSupported[i]
+      if (
+        candidate.length < compLang.length &&
+        candidate.length > longestMatchLength &&
+        compLang.startsWith(candidate) &&
+        compLang[candidate.length] === '-'
+      ) {
+        longestMatchIndex = i
+        longestMatchLength = candidate.length
       }
     }
+    if (longestMatchIndex !== -1) {
+      return options.supportedLanguages[longestMatchIndex]
+    }
 
     return undefined
   } catch {

Source: GitHub Commit f70e2c3. The patch replaces the quadratic prefix-rebuilding loop with a single linear scan over the supported languages list using startsWith comparisons.

Detection Methods for CVE-2026-71848

Indicators of Compromise

HTTP requests containing Accept-Language headers, cookies, or query parameters with unusually long hyphen-separated values (hundreds or thousands of subtags).
Sustained high CPU utilization on Node.js processes hosting Hono applications without a corresponding increase in request throughput.
Elevated event loop lag metrics on Hono workers during otherwise normal traffic volumes.

Detection Strategies

Inspect ingress logs for requests whose language-related fields exceed a reasonable length threshold, such as 100 characters or more than 20 hyphens.
Correlate slow request handlers with the presence of the languageDetector middleware in the request path.
Baseline normal Accept-Language header length distributions and alert on statistical outliers.

Monitoring Recommendations

Emit and monitor per-request handler duration for routes protected by languageDetector().
Track Node.js event loop lag and process CPU time with an APM agent and alert on sustained saturation.
Rate-limit unauthenticated endpoints at the reverse proxy or WAF layer to bound attacker request volume.

How to Mitigate CVE-2026-71848

Immediate Actions Required

Upgrade Hono to version 4.12.34 or later, which contains the linear-time fix in normalizeLanguage().
Audit application code for use of languageDetector() and confirm which sources are enabled in the detector order.
Deploy an ingress rule that rejects language-carrying inputs above a bounded length until patching is complete.

Patch Information

The fix is available in the Hono v4.12.34 release. Full technical details are published in GHSA-54fx-42gc-7vw4. The patched code replaces prefix reconstruction with a single pass over compSupported, comparing each supported tag against the input using startsWith.

Workarounds

Reorder the languageDetector sources to exclude unauthenticated inputs such as header, cookie, and querystring until the upgrade is applied.
Add middleware that truncates or rejects Accept-Language headers, cookies, and query parameters exceeding a fixed subtag count.
Terminate abnormally long language tags at the WAF or reverse proxy before requests reach the Hono application.

bash

# Upgrade Hono to the patched release
npm install hono@4.12.34

# Verify installed version
npm ls hono