What is the CVSS score of EUVD-2026-54578?

EUVD-2026-54578 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.3%.

Is there a public PoC exploit available for EUVD-2026-54578?

Yes, a public proof-of-concept exploit is available for EUVD-2026-54578. Prioritise patching immediately. EPSS: 0.3%.

Is there a patch available for EUVD-2026-54578?

Yes, a patch is available for EUVD-2026-54578. Update the affected software to the latest version immediately.

Hono EUVD-2026-54578

Q: Which versions of Hono are affected by EUVD-2026-54578?

Quadratic-complexity denial of service in Hono's `languageDetector` middleware (versions 4.12.0-4.12.33) allows unauthenticated remote attackers to exhaust CPU resources by sending HTTP requests with…. A patch is available.

| CVE-2026-71848 MEDIUM

Inefficient Algorithmic Complexity (CWE-407)

2026-08-07 GitHub_M

GHSA-54fx-42gc-7vw4

Denial Of Service Hono Honojs

5.3

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

vuln.today AI

5.3 MEDIUM

Network-accessible via default HTTP inputs with no auth required; A:L reflects partial availability impact bounded by runtime request-size limits rather than full service collapse.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Source Code Evidence Fetched

Aug 07, 2026 - 19:18 vuln.today

Analysis Generated

Aug 07, 2026 - 19:18 vuln.today

Patch available

Aug 07, 2026 - 19:02 EUVD

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

7 npm packages depend on hono (4 direct, 3 indirect)

Ecosystem-wide dependent count for version 4.12.0.

DescriptionCVE.org

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.0 to 4.12.33, the languageDetector middleware is vulnerable to algorithmic complexity denial of service when processing a crafted language tag containing a large number of hyphen separated subtags. To implement progressive language tag truncation, normalizeLanguage() repeatedly calls parts.slice(0, i).join('-') for every possible prefix, so the total amount of string processing grows quadratically with the number of subtags. Language values may come from a query parameter, cookie, Accept-Language header, or URL path, depending on the detector configuration, and the default detector order enables query string, cookie, and header detection, so applications using languageDetector() may expose this processing to unauthenticated requests. An attacker may repeatedly send requests containing long, hyphen separated language tags, causing excessive CPU consumption and preventing unrelated requests from being processed. This issue is fixed in version 4.12.34.

AnalysisAI

Quadratic-complexity denial of service in Hono's languageDetector middleware (versions 4.12.0-4.12.33) allows unauthenticated remote attackers to exhaust CPU resources by sending HTTP requests with crafted language tags containing large numbers of hyphen-separated subtags. The default middleware configuration accepts language values from query parameters, cookies, and the Accept-Language header without authentication, meaning the vulnerable code path is reachable from the network in any default Hono deployment using this middleware. No public exploit code has been identified and this CVE is not in the CISA KEV catalog, but the attack is trivially constructible from the advisory description; the fix was released in version 4.12.34.

Technical ContextAI

Hono (CPE: cpe:2.3:a:honojs:hono:*:*:*:*:*:*:*:*) is a lightweight TypeScript/JavaScript web framework targeting any JS runtime including Cloudflare Workers, Deno, Bun, and Node.js. The root cause is CWE-407 (Algorithmic Complexity): the normalizeLanguage() function in the languageDetector middleware splits a user-supplied language tag on hyphens and reconstructs every shorter prefix via parts.slice(0, i).join('-') inside a loop, producing O(N²) string operations for an input with N subtags. Because language values are sourced from user-controlled HTTP inputs - Accept-Language header, query parameters, cookies, or URL path, with all three of the first options enabled by default - the attacker-controlled input is fed directly into this quadratic loop. The fix (commit f70e2c3) inverts the algorithm to iterate over the bounded list of configured supported languages rather than over prefixes of the unbounded attacker input, reducing complexity to O(M) where M is the number of configured languages.

RemediationAI

Upgrade the hono npm package to version 4.12.34 or later, which replaces the quadratic prefix-reconstruction loop with a linear scan over the bounded supported-languages list (patch commit f70e2c31684387b3231cc38512a31df6ca76a1c7, available at https://github.com/honojs/hono/commit/f70e2c31684387b3231cc38512a31df6ca76a1c7; full release at https://github.com/honojs/hono/releases/tag/v4.12.34). If immediate upgrade is not feasible, disable the languageDetector() middleware entirely as a compensating control - trade-off is loss of automatic language negotiation, which may break internationalization features. Alternatively, enforce strict length limits on the Accept-Language header and language-related query parameters at the reverse proxy or WAF layer (e.g., reject headers exceeding 256 characters); this reduces per-request cost but does not fully eliminate the issue as the advisory confirms inputs within typical runtime limits can still cause event-loop blocking. Rate-limiting unauthenticated requests at the edge provides an additional layer of defense without application changes.