AutoMapper’s Licensing and Security Dilemma

AutoMapper has been a popular choice for object-to-object mapping in .NET applications for many years. However, its licensing change and a recently disclosed security vulnerability have created a difficult decision for development teams.

Problem

AutoMapper version 14.0.0 is the final version available under the previous free, permissive licence. Starting with version 15, AutoMapper requires a licence. Depending on the organisation and its eligibility for a free licence, continued commercial use may involve licensing costs.

At the same time, security advisory GHSA-rvv3-g6hj-g44x affects AutoMapper 14.0.0 and many other versions.

Cause

AutoMapper recursively maps deeply nested and self-referential object graphs without enforcing a default maximum depth.

A specially constructed object graph can exhaust the application’s stack, causing a StackOverflowException. Because this exception terminates the process in modern .NET applications, the vulnerability can result in a denial-of-service attack.

Impact

Teams using AutoMapper are effectively faced with several costly options:

• Purchase or obtain an appropriate AutoMapper licence and upgrade to at least version 15.1.1 or 16.1.1.
• Replace AutoMapper with a free alternative such as Mapperly, which may require significant source-code changes and testing.
• Apply a temporary workaround and suppress the associated NuGet audit warning.

Both upgrading and migrating can involve considerable licensing costs, development time, regression testing and deployment effort.

Temporary Solution

A maximum mapping depth can be configured globally in Program.cs to prevent uncontrolled recursion:

services.AddSingleton(provider => new MapperConfiguration(cfg =>
{
    cfg.Internal().ForAllMaps((typeMap, map) =>
    {
        // GHSA-rvv3-g6hj-g44x: AutoMapper DoS vulnerability via uncontrolled recursion.
        // To prevent license costs apply default maxDepth of 64 for self-referential types.
        map.MaxDepth(64);
    });
}).CreateMapper());

After reviewing and testing the mitigation, the NuGet audit warning can be suppressed in the project file:

<NuGetAuditSuppress Include="https://github.com/advisories/GHSA-rvv3-g6hj-g44x"
        PackageId="AutoMapper"
        Reason="Known advisory; internal work around applied" />

Suppressing the warning should only be done after confirming that the mitigation is applied to every relevant mapping configuration. The decision should also be documented so that future maintainers understand why the warning was suppressed.

Long-Term Solution

This workaround reduces the immediate risk, but it does not remove the vulnerability from the AutoMapper package itself.

Because version 14.0.0 is no longer receiving (security) updates, remaining on this version creates increasing technical and security debt. The workaround should therefore be treated as a temporary measure while the organisation evaluates purchasing a licence or migrating to an actively maintained alternative.