AUTOMAPPER · CVE-2026-128082 · Package
FIX → 16.3.0 · 15.1.4
AutoMapper's MaxDepth limit is not enforced when recursion goes through constructor parameters, such as positional records. Mapping deeply nested attacker-influenced data to such a type overflows the stack, which cannot be caught and terminates the process.
first public Nov 5, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Applications that use AutoMapper to map deeply nested, attacker-influenced data into a destination type created through a constructor that references its own type, such as a positional record. The MaxDepth setting does not protect these mappings. Applications that only map flat data, or whose inputs are trusted and shallow, are not exposed in practice.
Not affected if flat-or-trusted-input, no-recursive-constructor-types, versions-outside-range
Who cares automapper, csharp, dotnet, records
dotnet list package; affected versions are 16.0.0 to below 16.3.0, and below 15.1.4.CreateMap calls on types with recursive members that are built through a constructor (positional records, ConstructUsing calling context.Mapper).MaxDepth, whether set explicitly or applied by default (64) to self-referential type maps, was not enforced when the recursion goes through constructor parameters. Mapping a deeply nested source to a destination built through its constructor, such as a positional record, recurses without bound and throws a StackOverflowException. That exception can't be caught and terminates the process. This bypasses the mitigation for CVE-2026-32933.
The type depth used by MaxDepth was incremented only after the destination object was created. Constructor parameters, including child objects of the same type, are mapped while the destination is created, so each level recursed before its parent was counted, and the depth check never tripped.
Affected:
MaxDepth(n) and the default limit of 64ConstructUsing that maps recursively through context.MapperWith MaxDepth(10), a 100-level chain was mapped to all 100 levels. On a 1 MB stack (the Windows default), the process crashed at between 1,000 and 2,000 levels.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
Upgrade to 16.3.0 · 15.1.4
16.3.015.1.4The type only has a constructor with positional arguments, and MaxDepth is set to 10:
using AutoMapper;
// Setup configuration - with MaxDepth set
var mapper = new MapperConfiguration(cfg =>
{
cfg.CreateMap<CircularClass, CircularClass>().MaxDepth(10);
})
.CreateMapper();
// Create a deeply nested object (28,000+ levels)
var root = new CircularClass(null);
var current = root;
for (int i = 0; i < 30000; i++)
{
current.Next = new CircularClass(null);
current = current.Next;
}
// STACK OVERFLOW even though the max depth is set
var mappedRoot = mapper.Map<CircularClass>(root);
public class CircularClass
{
public CircularClass(CircularClass? Next)
{
this.Next = Next;
}
public CircularClass? Next { get; set; }
}
Any application that maps attacker-influenced, deeply nested data to a destination type built through a constructor, with a recursive member, can be crashed. Setting MaxDepth as recommended for CVE-2026-32933 doesn't protect these mappings.
Fixed in 16.3.0 and 15.1.4. The depth is now counted before the destination is created, so constructor mapping stops at the same depth as property mapping.
If the destination type has a parameterless constructor and settable properties, cfg.DisableConstructorMapping() makes AutoMapper map through the properties, where MaxDepth is enforced. Positional records have no workaround other than limiting input depth before mapping, or upgrading.
Reported by @mcambria, who found it while writing a test to confirm their MaxDepth mitigation for CVE-2026-32933.
MaxDepth (polymorphic maps, runtime-typed members, dictionary and dynamic sources, recursive type converters), fixed in the same releases.This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.