NuGet: 'error NU1903: Package has a known high severity vulnerability'

error NU1903: Warning As Error: Package 'Newtonsoft.Json' 12.0.2 has a known high severity vulnerability is NuGet's audit telling you that a package in your dependency graph has a published security advisory. It is a warning; it fails the build because the project treats warnings as errors. Move to a version the advisory lists as fixed.

If the package is one you reference, raise its version. If it arrives through another package, as here, either update that parent package or add a direct PackageReference to the fixed version, which wins over the transitive one.

The error

  Determining projects to restore...
...\VulnLab\VulnLab.csproj : error NU1903: Warning As Error: Package 'Newtonsoft.Json' 12.0.2 has a known high severity vulnerability, https://github.com/advisories/GHSA-5crp-9r3c-p9vr
  Failed to restore ...\VulnLab\VulnLab.csproj (in 1.2 sec).

Build FAILED.

The project path is shortened; nothing else in the output was changed.

Why it happens

During restore NuGet downloads the vulnerability data from the sources and checks every resolved package against it. Another test project showed NU1902 for a moderate advisory (System.Security.Cryptography.Pkcs 9.0.11), so the code changes with the severity. The link is the GitHub advisory, which names the affected and the patched versions. A copy of the project without TreatWarningsAsErrors printed the same line as warning NU1903 and the build succeeded; with it, restore fails and nothing compiles.

The project here never mentioned Newtonsoft.Json. It referenced Microsoft.AspNetCore.JsonPatch 3.1.0, which depends on Newtonsoft.Json 12.0.2, and the audit flagged that transitive package. That is why the first search in your .csproj often finds nothing. Version 3.1.32 of the same package did not trigger it, because it depends on Newtonsoft.Json 13.0.1.

The fix

dotnet add package Newtonsoft.Json --version 13.0.3
dotnet build

<PackageReference Include="Microsoft.AspNetCore.JsonPatch" Version="3.1.0" />
<PackageReference Include="Newtonsoft.Json" Version="13.0.3" />

The direct reference lifts the transitive package to 13.0.3, and the build succeeded with 0 warnings. Check the result with the command below, which then reported "no vulnerable packages given the current sources":

dotnet list package --vulnerable --include-transitive

The cleaner fix, when it exists, is a newer parent. Removing the direct reference and running dotnet add package Microsoft.AspNetCore.JsonPatch --version 3.1.32 also built with 0 warnings. Use the direct reference when the parent has no release with a fixed dependency, and remove it again once one ships. Suppressing the warning hides a real advisory; read it first and decide whether it applies to how you use the package.

How it was reproduced

A dotnet new console project on .NET SDK 10.0.403 targeting net10.0, with TreatWarningsAsErrors set to true and one reference, Microsoft.AspNetCore.JsonPatch 3.1.0. The audit ran during the restore of dotnet build, with no extra setting. On its own, a direct reference to System.Text.Json 8.0.4 gave the same code as a warning, pointing at GHSA-8g4q-xg66-9fp4.

Frequently asked

What does NU1903 known high severity vulnerability mean?

NuGet's audit found a package in your dependency graph with a published high severity advisory. The link in the message is the GitHub advisory, which lists the patched versions.

How do I fix a vulnerable transitive NuGet package?

Update the package that pulls it in to a version that depends on a fixed release, or add a direct PackageReference to the fixed version. Confirm with dotnet list package --vulnerable --include-transitive.

Why does NU1903 fail my build when it is a warning?

The project sets TreatWarningsAsErrors, so restore turns every warning into an error. The message then reads Warning As Error and the build stops before compiling.

More decoded errors in the Fixes category. If raising a version makes another package complain, see NU1605: Detected package downgrade.