{"id":"CVE-2026-71848","sourceIdentifier":"security-advisories@github.com","published":"2026-08-07T19:18:53.950","lastModified":"2026-10-24T15:10:00.190","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.0 to 4.12.33, the languageDetector middleware is vulnerable to algorithmic complexity denial of service when processing a crafted language tag containing a large number of hyphen separated subtags. To implement progressive language tag truncation, normalizeLanguage() repeatedly calls parts.slice(0, i).join('-') for every possible prefix, so the total amount of string processing grows quadratically with the number of subtags. Language values may come from a query parameter, cookie, Accept-Language header, or URL path, depending on the detector configuration, and the default detector order enables query string, cookie, and header detection, so applications using languageDetector() may expose this processing to unauthenticated requests. An attacker may repeatedly send requests containing long, hyphen separated language tags, causing excessive CPU consumption and preventing unrelated requests from being processed. This issue is fixed in version 4.12.34."},{"lang":"es","value":"Hono es un framework de aplicación web que proporciona soporte para cualquier entorno de ejecución de JavaScript. Desde la versión 4.12.0 hasta la 4.12.33, el middleware languageDetector es vulnerable a una denegación de servicio por complejidad algorítmica al procesar una etiqueta de idioma manipulada que contiene un gran número de subtags separadas por guiones. Para implementar la truncación progresiva de etiquetas de idioma, normalizeLanguage() llama repetidamente a parts.slice(0, i).join(’-’) para cada prefijo posible, por lo que la cantidad total de procesamiento de cadenas crece cuadráticamente con el número de subtags. Los valores de idioma pueden provenir de un parámetro de consulta, una cookie, un encabezado Accept-Language o una ruta URL, dependiendo de la configuración del detector, y el orden predeterminado del detector habilita la detección de cadena de consulta, cookie y encabezado, por lo que las aplicaciones que utilizan languageDetector() pueden exponer este procesamiento a solicitudes no autenticadas. Un atacante puede enviar repetidamente solicitudes que contengan etiquetas de idioma largas y separadas por guiones, causando un consumo excesivo de CPU e impidiendo que se procesen solicitudes no relacionadas. Este problema está solucionado en la versión 4.12.34."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"honojs","product":"hono","versions":[{"version":">= 4.12.0, < 4.12.34","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-08T03:04:31.560320Z","id":"CVE-2026-71848","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-407"}]}],"references":[{"url":"https://github.com/honojs/hono/commit/f70e2c31684387b3231cc38512a31df6ca76a1c7","source":"security-advisories@github.com"},{"url":"https://github.com/honojs/hono/releases/tag/v4.12.34","source":"security-advisories@github.com"},{"url":"https://github.com/honojs/hono/security/advisories/GHSA-54fx-42gc-7vw4","source":"security-advisories@github.com"}]}