NSS 3.125.1 release notes

Introduction

Network Security Services (NSS) 3.125.1 was released on 2 November 2026.

Distribution Information

The HG tag is NSS_3_125_1_RTM. NSS 3.125.1 requires NSPR 4.38.2 or newer.

NSS 3.125.1 source distributions are available on ftp.mozilla.org for secure HTTPS download:

• Source tarballs: https://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/NSS_3_125_1_RTM/src/

Other releases are available Release Notes.

Changes in NSS 3.125.1

• Bug 2088196 - backport nssckbi 2.92.

• Bug 2082793 - Don’t cache sessions when ECH was rejected.

• Bug 2082792 - Keep DTLS handshake messages whole in the send buffer.

• Bug 2082077 - Initialize sftk_MACCtx in sftk_MAC_Init.

• Bug 2082027 - reorder session context setup in sftk_doMACInit.

• Bug 2054723 - harden against integer overflows in lowpbe.c.

• Bug 2054697 - fix AES GCM parameter serialization in pk11_GetPBECryptoMechanism.

• Bug 2054695 - handle HMAC truncation when using PK11_Digest* APIs.

• Bug 2054616 - reject short ciphertexts in sec_pkcs5_rc2.