Network Security Services (NSS) 3.131 was released on *6 October 2026*. Distribution Information <http://gecko-docs.mozilla.org-l1.s3-website.us-west-2.amazonaws.com/main/a693f1e0-c1bc-11f1-abbb-863ac22d0807/security/nss/releases/nss_3_131.html#distribution-information>
The HG tag is NSS_3_131_RTM. NSS 3.131 requires NSPR 4.39 or newer. NSS 3.131 source distributions are available on ftp.mozilla.org for secure HTTPS download: - Source tarballs: https://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/NSS_3_131_RTM/src/ Other releases are available Release Notes <http://gecko-docs.mozilla.org-l1.s3-website.us-west-2.amazonaws.com/main/a693f1e0-c1bc-11f1-abbb-863ac22d0807/security/nss/releases/index.html#mozilla-projects-nss-releases> . Changes in NSS 3.131 <http://gecko-docs.mozilla.org-l1.s3-website.us-west-2.amazonaws.com/main/a693f1e0-c1bc-11f1-abbb-863ac22d0807/security/nss/releases/nss_3_131.html#changes-in-nss-3-131> - Bug 2078438 <https://bugzilla.mozilla.org/show_bug.cgi?id=2078438> - remove unused private pkcs12, pkcs7, and smime functions. - Bug 2070738 <https://bugzilla.mozilla.org/show_bug.cgi?id=2070738> - Fix generating nss.pc with system-nspr. - Bug 2066048 <https://bugzilla.mozilla.org/show_bug.cgi?id=2066048> - replace sslSecurityInfo peerCert with peerCertDER. - Bug 2067244 <https://bugzilla.mozilla.org/show_bug.cgi?id=2067244> - remove support for inherited DSA parameters in libssl. - Bug 2017995 <https://bugzilla.mozilla.org/show_bug.cgi?id=2017995> - Fix issues with Unwrapping keys using tokens in FIPS mode. - Bug 2069886 <https://bugzilla.mozilla.org/show_bug.cgi?id=2069886> - remove Windows-only AES-CTR implementation. - Bug 2069887 <https://bugzilla.mozilla.org/show_bug.cgi?id=2069887> - improve algorithm policy enforcement for ML-DSA. - Bug 2064512 <https://bugzilla.mozilla.org/show_bug.cgi?id=2064512> - reject non-RFC 8410 curve OIDs when encoding an X25519 or Ed25519 SubjectPublicKeyInfo. - Bug 2076212 <https://bugzilla.mozilla.org/show_bug.cgi?id=2076212> - Clear freed CMS members in the destructors. - Bug 2076212 <https://bugzilla.mozilla.org/show_bug.cgi?id=2076212> - Release the previous signer certificate when re-verifying a PKCS#7 signature. - Bug 2076212 <https://bugzilla.mozilla.org/show_bug.cgi?id=2076212> - Make SEC_PKCS7DecoderAbort fail the decode. - Bug 2076212 <https://bugzilla.mozilla.org/show_bug.cgi?id=2076212> - Fail closed after an incomplete PKCS#12 decode. - Bug 2076240 <https://bugzilla.mozilla.org/show_bug.cgi?id=2076240> - remove unused NSSCryptoContext and NSSTrustDomain functions. - Bug 1993638 <https://bugzilla.mozilla.org/show_bug.cgi?id=1993638> - can’t import eddsa .p12 from OpenSSL. - Bug 2055638 <https://bugzilla.mozilla.org/show_bug.cgi?id=2055638> - fix clang format. - Bug 2072045 <https://bugzilla.mozilla.org/show_bug.cgi?id=2072045> - pk12util fails to import private key into SoftHSM token despite initialized slot and valid PKCS#12 file. - Bug 2075580 <https://bugzilla.mozilla.org/show_bug.cgi?id=2075580> - p7content: open output file in binary mode. - Bug 2068388 <https://bugzilla.mozilla.org/show_bug.cgi?id=2068388> - fix msvc build error. - Bug 2072416 <https://bugzilla.mozilla.org/show_bug.cgi?id=2072416> - use SEC_ASN1_GET for SEC_OctetStringTemplate in der_gtest. - Bug 2074663 <https://bugzilla.mozilla.org/show_bug.cgi?id=2074663> - remove unused and unexported CERT_ functions. - Bug 2072416 <https://bugzilla.mozilla.org/show_bug.cgi?id=2072416> - fix leak when decoding nested indefinite length octet strings with null arena. - Bug 2072416 <https://bugzilla.mozilla.org/show_bug.cgi?id=2072416> - Keep ASN.1 constructed-string substring allocations out of the caller’s SECItem. - Bug 2075525 <https://bugzilla.mozilla.org/show_bug.cgi?id=2075525> - link softoken_static_gtest against advapi32 on Windows. - Bug 2055638 <https://bugzilla.mozilla.org/show_bug.cgi?id=2055638> - add regression test for bug 2054616 <https://bugzilla.mozilla.org/show_bug.cgi?id=2054616>. - Bug 2055583 <https://bugzilla.mozilla.org/show_bug.cgi?id=2055583> - add regression test for bug 2054719 <https://bugzilla.mozilla.org/show_bug.cgi?id=2054719>. - Bug 2075289 <https://bugzilla.mozilla.org/show_bug.cgi?id=2075289> - httpserv: OCSP responses are sent without a Content-Length header. - Bug 2075021 <https://bugzilla.mozilla.org/show_bug.cgi?id=2075021> - remove unused private PK11_ functions. - Bug 2075291 <https://bugzilla.mozilla.org/show_bug.cgi?id=2075291> - avoid NULL dereference in NSS_CMSDigestContext_StartMultiple error path. - Bug 2073293 <https://bugzilla.mozilla.org/show_bug.cgi?id=2073293> - add CERT_GetDERCertTrust. - Bug 1719827 <https://bugzilla.mozilla.org/show_bug.cgi?id=1719827> - auto update key4db entry KDF iteration count on login. - Bug 2068388 <https://bugzilla.mozilla.org/show_bug.cgi?id=2068388> - reject RSA public exponents larger than 32 bits. - Bug 2075024 <https://bugzilla.mozilla.org/show_bug.cgi?id=2075024> - improve mach support for dist builds. - Bug 2037628 <https://bugzilla.mozilla.org/show_bug.cgi?id=2037628> - protect PK11SlotInfo::lastLoginCheck with PK11SlotInfo::nssTokenLock. - Bug 2047771 <https://bugzilla.mozilla.org/show_bug.cgi?id=2047771> - fix fips failures in debug builds. - Bug 2068381 <https://bugzilla.mozilla.org/show_bug.cgi?id=2068381> - fix error path double free of param_free in PK11_UnwrapPrivKey. - Bug 2074968 <https://bugzilla.mozilla.org/show_bug.cgi?id=2074968> - stub out DER_Lengths. Best, Dennis -- You received this message because you are subscribed to the Google Groups "[email protected]" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion visit https://groups.google.com/a/mozilla.org/d/msgid/dev-tech-crypto/CAON8YFPAY59oSjYucDGXH-RBGkL3P0DDiKN4f8Aa8TYSsOJ_sg%40mail.gmail.com.
