Network Security Services (NSS) 3.132 was released on 21 October 2026.
The HG tag is NSS_3_132_RTM. This version of NSS requires NSPR 4.39 or newer. The latest version of NSPR is 4.39. NSS 3.132 source distributions are available on ftp.mozilla.org for secure HTTPS download: <https://ftp.mozilla.org/pub/security/nss/releases/NSS_3_132_RTM/src/> Changes: Bug 2084101 - Remove eMudhra emSign Root CA - G3 from NSS. Bug 2083709 - Remove eMudhra emSign Root CA - C1 and emSign ECC Root CA - C3 from NSS. Bug 2056777 - fix build failures. Bug 2056777 - secasn1d: propagate end-of-contents flag to enclosing construct. Bug 2056777 - additional secasn1d tests for end of contents handling. Bug 2056777 - Changing the end_of_content for BER encoding. Bug 2064148 - run the FIPS-mode SSL tests in CI. Bug 2064148 - run fips.sh in CI. Bug 2064148 - run gtests in FIPS mode. Bug 2082675 - do not force-import an empty symmetric key. Bug 2082671 - allow unwrapping an EC private key without a public point. Bug 2064426 - DTLS1.3 must not use EndOfEarlyData (per RFC 9147 Section 5.6). Bug 2081444 - make clang-cl the default compiler for Windows in CI. Bug 2081444 - add option to build with clang-cl in CI. Bug 2075015 - prefer the seed format for wrapped ML-KEM and ML-DSA private keys. Bug 2074404 - Encode ML-DSA private keys in PK11_ExportPrivKeyInfo. Bug 2074404 - Encode ML-KEM private keys in PK11_ExportPrivKeyInfo. Bug 2081440 - use nspr4 branch tip for CI runs. Bug 2082406 - Read p7env and p7verify input in binary mode on Windows. Bug 2082407 - p7verify, p7content: exit non-zero on invalid signatures; fix p7verify SHA-384/512 digests. Bug 2050941 - libpkix http default client tests. Bug 2079860 - clear held back early data byte when 0rtt is rejected. Bug 2030245 - add Windows ARM64 CI jobs. Bug 2079416 - Update the wycheproof testvectors README. Bug 2079416 - Update ML-KEM wycheproof testvectors. Bug 2079416 - Update ML-DSA wycheproof testvectors. Bug 2079416 - Update DSA wycheproof testvectors. Bug 2079416 - Update RSA PKCS#1 v1.5 signature wycheproof testvectors. Bug 2079416 - Update RSA-PSS wycheproof testvectors. Bug 2079416 - Update RSA PKCS#1 v1.5 decryption wycheproof testvectors. Bug 2079416 - Update RSA-OAEP wycheproof testvectors. Bug 2079416 - Update EdDSA wycheproof testvectors. Bug 2079416 - Update ChaCha20-Poly1305 wycheproof testvectors. Bug 2079416 - Update ECDSA wycheproof testvectors. Bug 2079416 - Update ECDH wycheproof testvectors. Bug 2079416 - Update X25519 wycheproof testvectors. Bug 2079416 - Update HMAC wycheproof testvectors. Bug 2079416 - Update AES-CMAC wycheproof testvectors. Bug 2079416 - Update AES-CBC wycheproof testvectors. Bug 2079402 - read JSON directly for all wycheproof tests. Bug 2079457 - explicitly reject RSA PKCS#1 v1.5 ciphertexts that are not less than the modulus. Bug 2075179 - finalize the PRAGMA table_info statement on error paths in sdb_init. Bug 2076062 - Limit nesting depth in PKCS#12 safeContents decoder. Bug 2072757 - use encoded serial number to look up trust in fill_CERTCertificateFields. Bug 2077359 - remove unused SEC_ASN1_MKSUB from secsign.c. Bug 1961826 - Run NSS_Shutdown at exit in SMIME fuzzer. Bug 1961826 - Add streaming decoder pass to SMIME fuzzer. Bug 1961826 - Verify SignerInfos in SMIME fuzzer. Bug 1961826 - Regenerate test certs for SMIME fuzzer. Bug 1961826 - Add EC cert for ECDH and decrypt key callback to SMIME fuzzer. Bug 1961826 - Extend the SMIME fuzzer to cover more functions. Bug 390374 - return NULL for deprecated PBE functions. Bug 2061403 - Keep sigd->digests parallel to sigd->digestAlgorithms. Bug 2076696 - guard against integer overflow in PK11_HPKE_Seal and PK11_HPKE_Open. Bug 2076037 - ensure chacha20-poly1305 tag buffer is 16 bytes in PK11_AEADOp. Bug 2077359 - remove more unused functions from NSS. Bug 1960284 - Don't report epoch exhaustion through FatalError. NSS 3.132 shared libraries are backwards-compatible with all older NSS 3.x shared libraries. A program linked with older NSS 3.x shared libraries will work with this new version of the shared libraries without recompiling or relinking. Furthermore, applications that restrict their use of NSS APIs to the functions listed in NSS Public Functions will remain compatible with future versions of the NSS shared libraries. Bugs discovered should be reported by filing a bug report at <https://bugzilla.mozilla.org/enter_bug.cgi?product=NSS> Release notes are available at <https://firefox-source-docs.mozilla.org/security/nss/releases/index.html>. -- You received this message because you are subscribed to the Google Groups "[email protected]" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion visit https://groups.google.com/a/mozilla.org/d/msgid/dev-tech-crypto/CAFgAd7Hz9-E1nu3acmn%3D5H27GjGF0n3gOLoJSo3sbQDT1hxxaQ%40mail.gmail.com.
