AutoMapper stack overflow vulnerability: check versions and upgrade to a patched release

CVE-2026-128081 CVE-2026-32933

AutoMapper is affected by CVE-2026-128081, uncontrolled recursion that can cause a stack overflow and terminate the application process. Versions below 15.1.4 and from 16.0.0 to below 16.3.0 are affected; check packages and upgrade to 15.1.4 or 16.3.0.

AutoMapper stack overflow vulnerability: check versions and upgrade to a patched release

At a glance
AutoMapper has the uncontrolled recursion vulnerability CVE-2026-128081.
Deeply nested data can cause a StackOverflowException and terminate the application process.
Versions below 15.1.4 and from 16.0.0 to below 16.3.0 are affected.
Check packages and upgrade to 15.1.4 or 16.3.0, depending on the branch in use.

In this article

GitHub Advisories published an alert about a stack overflow vulnerability in AutoMapper, a .NET library for mapping data between objects. Prioritize checking the version used by your project and upgrading to the corresponding patched release.

Overview and technical details

The vulnerability, CVE-2026-128081, is classified as CWE-674 (Uncontrolled Recursion). Its score is CVSS 7.5 under CVSS:3.1, with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

Field	Details
Product	AutoMapper, a .NET library for mapping data between objects
Identifiers	CVE-2026-128081; GHSA-gpwp-5797-mjff; CVE-2026-32933
Classification	CWE-674 (Uncontrolled Recursion)
CVSS	7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Affected systems

Product	Affected versions	Patched version
nuget:AutoMapper	>= 16.0.0, < 16.3.0	16.3.0
nuget:AutoMapper	< 15.1.4	15.1.4

Mechanism and impact

Some mapping paths can bypass the MaxDepth limit, including polymorphic mappings, object or interface members, Dictionary/dynamic sources, and recursive type converters. An attacker can supply deeply nested data to trigger an uncatchable StackOverflowException, causing the application process to terminate.

The advisory states that, with the default 1 MB stack on Windows, a few thousand nesting levels may be enough to cause the failure. The confirmed impact is disruption to application availability.

System checks

Check direct and transitive AutoMapper versions in the .NET project. If the package falls within an affected range, upgrade to the corresponding patched version.

dotnet list package --include-transitive

Remediation and mitigation

Prioritize upgrading: use AutoMapper 16.3.0 for the 16.0.0 to below 16.3.0 branch, or 15.1.4 for versions below 15.1.4.
Temporary mitigation: explicitly set MaxDepth on derived-type maps and maps invoked through object or interface members.
For Dictionary/dynamic sources and recursive type converters, limit input depth before mapping. The advisory states that no configuration workaround is available for these cases.