Denial of service (reflected DOM-based)
Summary: Reflected DOM-based vulnerabilities occur when data from a request is echoed into the immediate response inside a part of the DOM that a client-side script then processes unsafely, letting an attacker control a piece of the response such as a JavaScript string. DOM-based denial of service arises when a script passes controllable data to a problematic platform API, so a crafted URL visited by another user can make that user's computer consume excessive CPU or disk space, or cause the browser to reject localStorage writes or kill busy scripts.
Key Takeaway: The payload runs on the visitor's machine, not the server, so a single crafted URL can degrade a user's browser through an API call your server-side controls never see; Burp notes static analysis alone produces false positives, so confirming exploitability requires reviewing the code and execution paths.
Read the original at PortSwigger Research ↗
- Topics
- Endpoint & Network Security
- Related
- Adapting to AI penetration testing orchestrators: The Modern Security Model Cyber Risks · Nov 13, 2026Introducing Spend Management: Spending limits and alerts for Cloudflare Cyber Risks · Nov 13, 2026Choosing Que Paxa, an unusual consensus algorithm Cyber Risks · Nov 11, 2026