Client-side desync attacks
Summary: PortSwigger Research describes client-side desync (CSD) attacks, in which malicious JavaScript on an arbitrary domain makes a victim's browser send a request with an attacker-controlled prefix in its body, leaving that prefix on the server's TCP/TLS socket and desyncing the browser's own connection. Because CSD does not rely on parsing discrepancies between two servers, even single-server websites may be vulnerable, though the target server must not support HTTP/2 since the attack depends on HTTP/1.1 connection reuse.
Why it matters: The attack needs only a victim to visit a malicious page and a server that responds to POST requests without reading the body - endpoints like static files or server-level redirects - so a single-server site with no front-end/back-end split can still be poisoned, and the browser's cache can be poisoned with a redirect to deliver a payload.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026