AutoMapper: Uncontrolled Recursion with Constructor Parameters

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS

7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

• CVE-2026-128082: 0.66% estimated exploitation activity in the next 30 days; percentile 52.28 (FIRST EPSS, 2026-11-14). This is a model estimate, not proof of exploitation or customer exposure.

As published by the source; long descriptions are shortened.

Summary `MaxDepth`, whether set explicitly or applied by default (64) to self-referential type maps, was not enforced when the recursion goes through constructor parameters. Mapping a deeply nested source to a destination built through its constructor, such as a positional `record`, recurses without bound and throws a `StackOverflowException`. That exception can't be caught and terminates the process. This bypasses the mitigation for CVE-2026-32933.

Details The type depth used by `MaxDepth` was incremented only after the destination object was created. Constructor parameters, including child objects of the same type, are mapped while the destination is created, so each level recursed before its parent was counted, and the depth check never tripped. Affected: - destination types mapped through constructor parameters, including positional records - both an explicit `MaxDepth(n)` and the default limit of 64 - `ConstructUsing` that maps recursively through `context.Mapper` With…

Published by the source

13 Nov 2026, 19:21 UTC

Last modified by the source

13 Nov 2026, 19:30 UTC

Source last checked

14 Nov 2026, 08:40 UTC

1. Revision 2 · amended · 14 Nov 2026

   Amended from osv record GHSA-6vhm-j9h7-f9gh

2. Revision 1 · created · 13 Nov 2026

   Published from ghsa record GHSA-6vhm-j9h7-f9gh

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2026-128082

Advisory: AutoMapper: Uncontrolled Recursion with Constructor Parameters
IDs: CVE-2026-128082, GHSA-6vhm-j9h7-f9gh
Record: https://patchnext.com/advisories/cve-2026-128082 (revision 2, source checked 14 Nov 2026, 08:40 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: High (CVSS 7.5)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: automapper 16.3.0, 15.1.4. A vendor fix does not mean a deployment is fixed.

## Affected components
- NuGet automapper: affected >= 16.0.0, < 16.3.0; < 15.1.4; fixed in 15.1.4, 16.3.0

## Suggested inspection (read-only)
- NuGet automapper: check the installed version with your package manager.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on automapper.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://github.com/advisories/GHSA-6vhm-j9h7-f9gh (GitHub-reviewed advisory GHSA-6vhm-j9h7-f9gh lists affected ranges: NuGet automapper >=16.0.0 =0 <15.1.4)
- Verified: https://osv.dev/vulnerability/GHSA-6vhm-j9h7-f9gh (OSV record GHSA-6vhm-j9h7-f9gh lists affected ranges: NuGet automapper >=16.0.0 =0 <15.1.4 (fixed))

Commands are suggestions: review each one before running it.