DOM-based denial of service
Summary: PortSwigger describes DOM-based denial-of-service vulnerabilities as arising when a script passes attacker-controllable data in an unsafe way to a problematic platform API, such as one whose invocation can make the user's computer consume excessive CPU or disk space. The browser may then restrict the site's functionality, for example by rejecting attempts to store data in localStorage or killing busy scripts.
Key Takeaway: The consequence lands on the end user's machine, not your servers: a browser that kills busy scripts or blocks localStorage can break the site for that visitor, and the guidance is to stop untrusted data from reaching problematic platform APIs at all.
Read the original at PortSwigger Research ↗
- Topics
- Endpoint & Network Security
- Related
- Adapting to AI penetration testing orchestrators: The Modern Security Model Cyber Risks · Nov 13, 2026Introducing Spend Management: Spending limits and alerts for Cloudflare Cyber Risks · Nov 13, 2026Choosing Que Paxa, an unusual consensus algorithm Cyber Risks · Nov 11, 2026