Executive brief
Hono is a web framework used to build applications. A vulnerability in its language detection component allows an attacker to send specially crafted requests that consume excessive server resources. This can lead to a denial of service, making the application slow or unavailable for legitimate users.
Technical details
The vulnerability exists in the `normalizeLanguage()` function within the `languageDetector` middleware. The implementation of progressive language-tag truncation uses an inefficient algorithm that repeatedly calls `join()` on string prefixes, resulting in quadratic (O(n²)) time complexity relative to the number of hyphen-separated subtags. An unauthenticated remote attacker can trigger this by providing a long language tag via query parameters, cookies, or the `Accept-Language` header. This causes synchronous event-loop blocking and high CPU usage. The issue is fixed in version 4.12.34 by optimizing the lookup logic to avoid redundant string reconstruction.
Affected products
- honojs hono >= 4.12.0, < 4.12.34
Timeline
- 2026-08-03: patched: Fixed in version 4.12.34
- 2026-08-07: advisory