NSS 3.129 Release

[John Schanck]

Network Security Services (NSS) 3.129 was released on 9 September 2026.



The HG tag is NSS_3_129_RTM. This version of NSS requires NSPR 4.39 or
newer. The latest version of NSPR is 4.39.

NSS 3.129 source distributions are available on ftp.mozilla.org for
secure HTTPS download:

<https://ftp.mozilla.org/pub/security/nss/releases/NSS_3_129_RTM/src/>

Changes:

Bug 2068788 - emit static library names during static build.
Bug 2067434 - avoid building libcrux twice in makefile builds.
Bug 2068010 - fix non-linux arm64 makefile builds.
Bug 2017322 - set CKA_NSS_SERVER_DISTRUST_AFTER for CN=Izenpe.com.
Bug 2057185 - Document ./mach try and its Mercurial-only caveat in
CLAUDE.md.
Bug 2056793 - Add tests for concurrent channel info queries during
session replacement.
Bug 2056793 - take the session cache lock when reading ss->sec.ci.sid.
Bug 2066046 - Fix a race in STAN_GetNSSCertificate.
Bug 2066591 - Remove write-only blLib and libraryName statics from
freebl's lowhash_vector.
Bug 2025246 - fix unknown key error type in ssl_SetAuthKeyBits.
Bug 2065879 - re-vendor HACL* and simplify run_hacl.sh.
Bug 2065879 - stop clang-formatting the vendored HACL* code.
Bug 2068191 - add --dry-run to mach try to print job list.
Bug 2029288 - avoid integer overflow in PK11_BlockData.
Bug 2066960 - fix UB in ecperf.c.
Bug 2067239 - Old coverity issues.
Bug 2067237 - MLKEM mechinfo needs keys sizes.
Bug 2066900 - pin NSPR 4.40 in CI.
Bug 2066266 - ML-KEM-1024 incorrectly allows an explicit encapsulation seed.
Bug 2066265 - Support for ML-KEM-512 in freebl and softoken.
Bug 2060316 - remove support for pre-standard Kyber.
Bug 2065423 - Build NSPR out of tree, into the dist directory.
Bug 2065423 - Write a machine-readable summary.json for each test run.
Bug 2065423 - Fail test runs on UBSan errors and on core dumps in
debug builds.
Bug 2065423 - Link tests_results/latest at the newest test run.
Bug 2065423 - Resolve ssl_gtest_db.sh against QADIR.
Bug 2065423 - Generate nss.pc and nss-config into the dist directory.
Bug 2065423 - Add a --dist option to build.sh.
Bug 2065219 - Update Cryptofuzz version.
Bug 2056790 - Use PK11 digest contexts for explicit hashing in cryptohi.

NSS 3.129 shared libraries are backwards-compatible with all older NSS
3.x shared libraries. A program linked with older NSS 3.x shared
libraries will work with this new version of the shared libraries
without recompiling or relinking. Furthermore, applications that
restrict their use of NSS APIs to the functions listed in NSS Public
Functions will remain compatible with future versions of the NSS
shared libraries.

Bugs discovered should be reported by filing a bug report at
<https://bugzilla.mozilla.org/enter_bug.cgi?product=NSS>

Release notes are available at
<https://firefox-source-docs.mozilla.org/security/nss/releases/index.html>.