Network Security Services (NSS) 3.125.1 was released on 2 November 2026.
The HG tag is NSS_3_125_1_RTM. This version of NSS requires NSPR 4.38.2 or newer. The latest version of NSPR is 4.38.2. NSS 3.125.1 source distributions are available on ftp.mozilla.org for secure HTTPS download: <https://ftp.mozilla.org/pub/security/nss/releases/NSS_3_125_1_RTM/src/> Changes: Bug 2088196 - backport nssckbi 2.92. Bug 2082793 - Don't cache sessions when ECH was rejected. Bug 2082792 - Keep DTLS handshake messages whole in the send buffer. Bug 2082077 - Initialize sftk_MACCtx in sftk_MAC_Init. Bug 2082027 - reorder session context setup in sftk_doMACInit. Bug 2054723 - harden against integer overflows in lowpbe.c. Bug 2054697 - fix AES GCM parameter serialization in pk11_GetPBECryptoMechanism. Bug 2054695 - handle HMAC truncation when using PK11_Digest* APIs. Bug 2054616 - reject short ciphertexts in sec_pkcs5_rc2. NSS 3.125.1 shared libraries are backwards-compatible with all older NSS 3.x shared libraries. A program linked with older NSS 3.x shared libraries will work with this new version of the shared libraries without recompiling or relinking. Furthermore, applications that restrict their use of NSS APIs to the functions listed in NSS Public Functions will remain compatible with future versions of the NSS shared libraries. Bugs discovered should be reported by filing a bug report at <https://bugzilla.mozilla.org/enter_bug.cgi?product=NSS> Release notes are available at <https://firefox-source-docs.mozilla.org/security/nss/releases/index.html>. -- You received this message because you are subscribed to the Google Groups "[email protected]" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion visit https://groups.google.com/a/mozilla.org/d/msgid/dev-tech-crypto/CAFgAd7Ef55z4%3DH5juungSiwOdw5vcCFPr%2BA_Z1%2BmQFmQS%2BH9cg%40mail.gmail.com.
