NuGet Audit runs automatically during restore and warns about known vulnerabilities in your packages, using data from your configured audit sources. By default it checks direct dependencies, but for projects targeting net10.0 or higher the default becomes all dependencies, including transitive ones.
When it runs
Microsoft's documentation says restore runs automatically on common package operations, such as loading a project for the first time, adding, updating or removing a package. Your dependencies are checked against a list of known vulnerabilities from your audit sources. You then review the warnings and fix the vulnerable packages.
The three main settings
| Property | Default | Values | Meaning |
|---|---|---|---|
| NuGetAudit | true | true, false | Turn the experience on or off |
| NuGetAuditMode | direct (all for net10.0 or higher) | direct, all | Top-level only, or transitive too |
| NuGetAuditLevel | low | low, moderate, high, critical | Minimum severity to report |
The documentation recommends configuring audit at the repository level, in a shared MSBuild file. If a project multi-targets and any one target framework selects all, audit uses all for every target framework.
Setting the level to moderate hides low severity advisories. Decide that deliberately, since a low advisory in a widely exposed service may still matter.
Why mode matters
With direct, a vulnerable transitive package is not reported. The command line tool dotnet list package --vulnerable filters packages with known vulnerabilities, but the documentation notes that --include-transitive is not the default, so add it. If you are not on net10.0 yet, set the mode to all yourself.
Audit sources
Restore downloads a server's vulnerability information resource to compare. Sources are defined in the auditSources element of NuGet.Config. If a listed source provides no vulnerability data, warning NU1905 is raised. If auditSources is not defined, package sources are used, and that warning is suppressed. The documentation points out that one common defence against package substitution is a single package source that upstreams from nuget.org, and that audit sources let you still query nuget.org for vulnerability data in that case.
A rollout plan
- Set
NuGetAuditModeto all in a shared props file. - Keep the level at low at first, so you see the full picture.
- Treat warnings as build failures for high and critical, using your normal warning policy.
- For findings you accept, use the suppression feature, with an issue link and a review date. The feature table shows suppression is supported for PackageReference from NuGet 6.11.
- Run restore on a schedule in CI, since new advisories arrive without a code change.
- Review the NU1905 warning in logs, so a blind audit source is noticed.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how transitive packages appear alongside direct ones.
Where Safeguard fits
Safeguard's SBOM and dependency scanning checks the dependencies you ship against advisory data, and its policies and gates can enforce a threshold on pull requests. A free scan is at https://gold.safeguard.sh/scan.
Quick check
Does NuGet Audit check transitive packages?
By default only direct ones, except for projects targeting net10.0 or higher, where the default is all.
What does warning NU1905 mean?
An audit source did not provide vulnerability information.
Sources
- Auditing package dependencies for security vulnerabilities, Microsoft Learn, fetched 19 October 2026.
Last reviewed: 19 October 2026.
