NSS 3.129 release notes

Introduction

Network Security Services (NSS) 3.129 was released on 9 September 2026.

Distribution Information

The HG tag is NSS_3_129_RTM. NSS 3.129 requires NSPR 4.39 or newer.

NSS 3.129 source distributions are available on ftp.mozilla.org for secure HTTPS download:

Other releases are available Release Notes.

Changes in NSS 3.129

  • Bug 2068788 - emit static library names during static build.

  • Bug 2067434 - avoid building libcrux twice in makefile builds.

  • Bug 2068010 - fix non-linux arm64 makefile builds.

  • Bug 2017322 - set CKA_NSS_SERVER_DISTRUST_AFTER for CN=Izenpe.com.

  • Bug 2057185 - Document ./mach try and its Mercurial-only caveat in CLAUDE.md.

  • Bug 2056793 - Add tests for concurrent channel info queries during session replacement.

  • Bug 2056793 - take the session cache lock when reading ss->sec.ci.sid.

  • Bug 2066046 - Fix a race in STAN_GetNSSCertificate.

  • Bug 2066591 - Remove write-only blLib and libraryName statics from freebl’s lowhash_vector.

  • Bug 2025246 - fix unknown key error type in ssl_SetAuthKeyBits.

  • Bug 2065879 - re-vendor HACL* and simplify run_hacl.sh.

  • Bug 2065879 - stop clang-formatting the vendored HACL* code.

  • Bug 2068191 - add –dry-run to mach try to print job list.

  • Bug 2029288 - avoid integer overflow in PK11_BlockData.

  • Bug 2066960 - fix UB in ecperf.c.

  • Bug 2067239 - Old coverity issues.

  • Bug 2067237 - MLKEM mechinfo needs keys sizes.

  • Bug 2066900 - pin NSPR 4.40 in CI.

  • Bug 2066266 - ML-KEM-1024 incorrectly allows an explicit encapsulation seed.

  • Bug 2066265 - Support for ML-KEM-512 in freebl and softoken.

  • Bug 2060316 - remove support for pre-standard Kyber.

  • Bug 2065423 - Build NSPR out of tree, into the dist directory.

  • Bug 2065423 - Write a machine-readable summary.json for each test run.

  • Bug 2065423 - Fail test runs on UBSan errors and on core dumps in debug builds.

  • Bug 2065423 - Link tests_results/latest at the newest test run.

  • Bug 2065423 - Resolve ssl_gtest_db.sh against QADIR.

  • Bug 2065423 - Generate nss.pc and nss-config into the dist directory.

  • Bug 2065423 - Add a –dist option to build.sh.

  • Bug 2065219 - Update Cryptofuzz version.

  • Bug 2056790 - Use PK11 digest contexts for explicit hashing in cryptohi.