NSS 3.133 release notes

Introduction

Network Security Services (NSS) 3.133 was released on 4 November 2026.

Distribution Information

The HG tag is NSS_3_133_RTM. NSS 3.133 requires NSPR 4.39 or newer.

NSS 3.133 source distributions are available on ftp.mozilla.org for secure HTTPS download:

Other releases are available Release Notes.

Changes in NSS 3.133

  • Bug 1989541 - Use FIPS-aware key extraction in the PBKDF2 long password test.

  • Bug 1989541 - Prehash PBKDF2 passwords longer than the HMAC block size.

  • Bug 1989541 - Use CK_PKCS5_PBKD2_PARAMS with softoken older than 3.114.

  • Bug 2087641 - Harden inline attribute value handling in softoken.

  • Bug 2082793 - Don’t cache sessions when ECH was rejected.

  • Bug 2082792 - Keep DTLS handshake messages whole in the send buffer.

  • Bug 2082077 - Initialize sftk_MACCtx in sftk_MAC_Init.

  • Bug 2082027 - reorder session context setup in sftk_doMACInit.

  • Bug 2083840 - Move CLAUDE.md into AGENTS.md.

  • Bug 2083840 - Add text to CLAUDE.md regarding code comments and searchfox-cli.

  • Bug 2084251 - Fix cf_status_nss clearing base-release bugs on point releases.

  • Bug 2039884 - Use vectorized Hacl_Chacha20Poly1305_128 on aarch64 above 512 bytes.

  • Bug 2046805 - Add SSL_EnablePlaintextResumptionExport experimental API.

  • Bug 2046805 - Collapse resumption token append boilerplate into macros.

  • Bug 2086058 - Reject not empty parameters in ML-KEM && ML-DSA AlgorithmIdentifiers.

  • Bug 2085825 - harden release assertion in sftk_DestroySessionObjectData.

  • Bug 2085776 - signver: Exit with 0 after a successful -A.