Zalgo-like Output Vulnerability in @soketi/soketi
Summary
GHSA-2w8g-m5j8-7m87: Zalgo-like output that crashes the server. Affects @soketi/soketi versions < 0.26.1. Fixed in 0.26.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @soketi/soketi package is an npm package that provides functionality for managing server connections. It is commonly used in Node.js applications to handle socket connections and facilitate real-time communication between clients and servers. The package offers various features and utilities for socket management, including color formatting for console output.
However, a vulnerability has been discovered in the package's dependency on the colors package. This vulnerability causes the server to crash when processing Zalgo-like output, which is text that contains excessive combining characters and diacritics. This issue affects only users who have recently upgraded or installed the @soketi/soketi package.
Vulnerability Detail
The vulnerability arises from the interaction between the @soketi/soketi package and its dependency on the colors package. When certain input containing Zalgo-like characters is processed by the colors package, it triggers a server crash. This can lead to service disruption and potential denial-of-service attacks.
It is important to note that Docker users who have bundled the dependencies at the time of the build are not affected, as the bundled dependencies were tested and do not include the vulnerable version of the colors package.
How To Fix
Latest published version: 1.6.1 as of 23 Oct 2026
npm install @soketi/soketi@1.6.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.26.1
This is the first release that contains the fix.
npm install @soketi/soketi@0.26.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Unfortunately, there is no workaround available for this vulnerability. As it is related to the package's dependencies, upgrading to the patched version is the only solution.
Conclusion
The Zalgo-like output vulnerability in the @soketi/soketi package can cause server crashes and service disruption. Users who have recently upgraded or installed the package should promptly upgrade to version 0.26.1 to mitigate the risk. Docker users who have bundled the dependencies at the time of the build are not affected. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for @soketi/soketi →
FAQ
Only users who have recently upgraded or installed the @soketi/soketi package are affected by this vulnerability. Docker users who have bundled the dependencies at the time of the build are not affected.
Zalgo-like output refers to text that contains excessive combining characters and diacritics. It is often used to create visually distorted or glitchy text effects.
The vulnerability can lead to server crashes, causing service disruption and potential denial-of-service attacks. It is important to promptly upgrade to the patched version to mitigate these risks.
No, Docker users who have bundled the dependencies at the time of the build are not affected by this vulnerability. The bundled dependencies were tested and do not include the vulnerable version of the colors package.
No, upgrading to the patched version is the only solution to fix this vulnerability. As it is related to the package's dependencies, there are no workarounds available.
References
Related vulnerabilities
Recent vulnerabilities recorded for @soketi/soketi.
