Duende.BFF 3.1.2
This release moves BFF's dependencies onto the .NET October 2026 security updates. BFF's own code hasn't changed.
Blazor WebAssembly (CVE-2026-70183)
Microsoft fixed a vulnerability in Blazor's AuthorizeRouteView, which could use a stale authorization result after navigation. Blazor WebAssembly apps load Microsoft.AspNetCore.Components.Authorization from the NuGet package, not from the server's runtime, so updating the runtime on your servers doesn't fix it.
Duende.BFF.Blazor.Client 3.1.2 now requires the patched version of that package for each target framework, so upgrading BFF picks up the fix for you. You can also reference the patched Microsoft.AspNetCore.Components.Authorization directly in your WebAssembly client project.
Update the .NET runtime on your hosts
Most of the October 2026 .NET vulnerabilities are in the ASP.NET Core shared framework, including critical Kestrel fixes for HTTP/1 request smuggling (CVE-2026-88092) and HTTP/2 header handling (CVE-2026-70188). Your app uses the shared framework installed on the host or in the container base image, so upgrading the BFF packages doesn't fix these. Update your hosts and container images to the October 2026 .NET runtime for the .NET version you run.
Developers working on Blazor WebAssembly apps should also update their .NET SDK, which fixes the WebAssembly debug proxy and dev server vulnerabilities (CVE-2026-102870, CVE-2026-96230).
Breaking changes
None.
Full Changelog: bff-3.1.1...bff-3.1.2