Hono’s languageDetector middleware processes language tags by repeatedly string‑slicing and joining each possible prefix. A crafted tag containing a large number of hyphen‑separated subtags causes this operation to grow quadratically with the tag length, leading to excessive CPU consumption. This weakness is classified as CWE-407: Algorithmic Complexity, and the DoS effect can block unrelated requests to the application, impacting availability for all users.

Any Hono application using version 4.12.0 through 4.12.33 and the languageDetector middleware is affected. The vulnerability can surface when language values come from query parameters, cookies, the Accept‑Language header, or the URL path, depending on detection configuration. Applications that enable query string, cookie, or header detection (the default order) expose this path to unauthenticated traffic.

The CVSS score of 5.3 indicates moderate severity. EPSS is not available and the issue is not listed in CISA KEV. An attacker can send unauthenticated HTTP requests with long, hyphen‑separated language tags to any endpoint that triggers languageDetector. Because the weakness is in the core framework, no special credentials are required, making exploitation straightforward and potentially disruptive to application availability.