Threats affecting pkg:nuget/automapper

CVE-2026-32933 is a high-severity vulnerability in LuckyPennySoftware's AutoMapper library for . NET, affecting versions prior to 15.1.1 and between 16.0.0 and 16.1.1. The flaw arises from uncontrolled recursion when mapping deeply nested object graphs, leading to stack exhaustion and a StackOverflowException that crashes the application process. This Denial of Service (DoS) vulnerability requires no authentication or user interaction and can be triggered remotely by supplying crafted input.