Hono EUVD-2026-54578

The application must use the languageDetector() middleware from Hono versions 4.12.0 through 4.12.33. With the default detector order (query string first, then cookie, then Accept-Language header), no authentication, login, or special privilege is required - any HTTP request reaching the application can supply a crafted language value. The critical bottleneck is triggered by a language tag with a large number of hyphen-separated subtags processed by normalizeLanguage(); the larger the number of subtags, the greater the CPU cost per request. Exploitation is bounded by the JavaScript runtime's request-size limits and by reverse-proxy header-size restrictions: applications behind infrastructure that enforces small Accept-Language header limits (e.g., under 1 KB) experience reduced but potentially still measurable event-loop blocking. Applications that have explicitly configured languageDetector() to use only URL-path detection (disabling query, cookie, and header detectors) and restrict path access with authentication have a significantly reduced attack surface.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L (5.3 Medium) accurately reflects a network-reachable, unauthenticated, low-complexity attack with partial availability impact. The quadratic complexity is confirmed by the GHSA advisory and the commit diff, and the default configuration exposes the vulnerable middleware to unauthenticated requests. However, several factors reduce real-world severity: the advisory explicitly notes that JavaScript runtime request-size limits and reverse-proxy configuration cap the cost of any single request; impact is CPU saturation and event-loop blocking rather than crash, data loss, or privilege escalation; and a sustained attack requires repeated requests, creating opportunity for rate-limiting defenses to intervene. No EPSS score was provided in the input data, so exploitation probability is unquantified from that signal. There is no KEV listing and no public POC, indicating no confirmed active exploitation. The gap between raw CVSS score and practical risk is moderate - applications behind CDNs, WAFs, or rate-limiting reverse proxies are substantially less exposed than directly internet-facing Hono services.

An unauthenticated attacker sends repeated HTTP requests to any endpoint of a Hono application using languageDetector(), each carrying an Accept-Language header with a deeply nested tag such as x-x-x-x-x-...-x containing thousands of hyphen-separated subtags. Each request forces normalizeLanguage() to perform O(N²) string operations synchronously on the JavaScript event loop, consuming CPU and delaying or dropping all concurrent legitimate requests; sustained flooding pushes the service into a degraded or unresponsive state. No public proof-of-concept code has been identified, but the attack is trivially constructible from the published advisory details.