Denial of service (stored DOM-based)
Summary: Stored DOM-based denial of service occurs when user input is stored and later embedded into a response within a part of the DOM that a client-side script processes unsafely, passing controllable data to a problematic platform API. An attacker can construct a URL that, when visited by another user, invokes that API and causes the user's computer to consume excessive CPU or disk space, potentially leading the browser to reject localStorage writes or kill busy scripts.
What's compelling: The payload sits in stored data and fires in other users' browsers, so a single crafted URL can degrade machines across your user base without touching your servers. PortSwigger notes Burp's static analysis can flag false positives, so a finding without dynamic evidence needs code and execution-path review before you treat it as real.
Read the original at PortSwigger Research ↗
- Topics
- Endpoint & Network Security
- Related
- Adapting to AI penetration testing orchestrators: The Modern Security Model Cyber Risks · Nov 13, 2026Introducing Spend Management: Spending limits and alerts for Cloudflare Cyber Risks · Nov 13, 2026Choosing Que Paxa, an unusual consensus algorithm Cyber Risks · Nov 11, 2026