Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

NuGet package

meridian.mediator

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.5NuGetPublished

    Meridian: Multiple defense-in-depth gaps (collection/depth caps, telemetry, retry, fan-out)

    GHSA-f5v8-v6q3-q4h6

    Affected
    • NuGet meridian.mediator >= 2.0.0, < 2.1.1
    Fixed in
    2.1.1· Vendor fix available
    Issue
    Meridian v2.1.0 (Meridian.Mapping and Meridian.Mediator) shipped with nine defense-in-depth gaps reachable through its public APIs. Two are HIGH severity — the advertised DefaultMaxCollectionItems and DefaultMaxDepth safety caps are silently bypassed on the IMapper.Map(source, destination) overload and anywhere .UseDestinationValue() is configured on a collection-typed property. Four are MEDIUM (constructor invariant bypass, OpenTelemetry stack-trace info disclosure, retry amplification, notification fan-out amplification). Three are LOW (exception message disclosure, dictionary duplicate-key echo, static mediator cache growth under closed-generic types). All nine are patched in v2.1.1. Upgrade is a drop-in NuGet bump; see the v2.1.1 CHANGELOG for the four behavioural changes (constructor selection, OTel default, publisher fan-out cap, retry caps). Severity Matrix | | Severity | CWE | Finding | Fix | |---|---|---|---|---| | 1 | HIGH | CWE-770 |…

    Recommended action: Upgrade to 2.1.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →