CVE-2026-71848 is a denial-of-service vulnerability in the languageDetector component of this framework, stemming from quadratic algorithmic complexity in the normalizeLanguage() function. When processing language tags, this function progressively truncates subtags — converting 'en-GB-scotland' to 'en-GB' then 'en' — by iterating through each possible truncation point and calling slice() and join() in a loop. For a language tag with n subtags, this produces O(n²) string operations on user-controlled input.
The critical factor elevating this from a code quality bug to a CVE is the default configuration. languageDetector() enables query parameter, cookie, and Accept-Language header detection by default, meaning any unauthenticated request can trigger this processing. A single crafted request with an artificially long language tag can consume disproportionate CPU and block the event loop, affecting unrelated requests in flight. This is not theoretical — the default-on configuration converts a string-helper inefficiency into an unauthenticated attack vector.
You should verify whether your application explicitly configures languageDetector sources. If you're passing no configuration to languageDetector(), you're exposing this processing path to all incoming requests. Upgrade to 4.12.34, which addresses the algorithmic complexity. After upgrading, consider explicitly configuring which sources are enabled rather than relying on defaults — explicitly limiting detection to trusted sources reduces your attack surface regardless of what future normalization helpers might contain.
The broader lesson: normalization and parsing helpers are an under-reviewed attack surface. The assumption that string manipulation is cheap and bounded breaks down when user input controls iteration count. Review your own utility functions for similar patterns where user-controlled length drives internal loops.