firefox-main/security/nss/doc/src/releases/nss_3_132.md

Source code

Revision control

Copy as Markdown

Other Tools

(mozilla-projects-nss-nss-3-132-release-notes)=
# NSS 3.132 release notes
## Introduction
:::{container}
Network Security Services (NSS) 3.132 was released on *21 October 2026*.
:::
## Distribution Information
:::{container}
The HG tag is NSS_3_132_RTM. NSS 3.132 requires NSPR 4.39 or newer.
NSS 3.132 source distributions are available on ftp.mozilla.org for secure HTTPS download:
- Source tarballs:
Other releases are available {ref}`mozilla-projects-nss-releases`.
:::
(changes-in-nss-3-132)=
## Changes in NSS 3.132
:::{container}
- Bug 2084101 - Remove eMudhra emSign Root CA - G3 from NSS.
- Bug 2083709 - Remove eMudhra emSign Root CA - C1 and emSign ECC Root CA - C3 from NSS.
- Bug 2056777 - fix build failures.
- Bug 2056777 - secasn1d: propagate end-of-contents flag to enclosing construct.
- Bug 2056777 - additional secasn1d tests for end of contents handling.
- Bug 2056777 - Changing the end_of_content for BER encoding.
- Bug 2064148 - run the FIPS-mode SSL tests in CI.
- Bug 2064148 - run fips.sh in CI.
- Bug 2064148 - run gtests in FIPS mode.
- Bug 2082675 - do not force-import an empty symmetric key.
- Bug 2082671 - allow unwrapping an EC private key without a public point.
- Bug 2064426 - DTLS1.3 must not use EndOfEarlyData (per RFC 9147 Section 5.6).
- Bug 2081444 - make clang-cl the default compiler for Windows in CI.
- Bug 2081444 - add option to build with clang-cl in CI.
- Bug 2075015 - prefer the seed format for wrapped ML-KEM and ML-DSA private keys.
- Bug 2074404 - Encode ML-DSA private keys in PK11_ExportPrivKeyInfo.
- Bug 2074404 - Encode ML-KEM private keys in PK11_ExportPrivKeyInfo.
- Bug 2081440 - use nspr4 branch tip for CI runs.
- Bug 2082406 - Read p7env and p7verify input in binary mode on Windows.
- Bug 2082407 - p7verify, p7content: exit non-zero on invalid signatures; fix p7verify SHA-384/512 digests.
- Bug 2050941 - libpkix http default client tests.
- Bug 2079860 - clear held back early data byte when 0rtt is rejected.
- Bug 2030245 - add Windows ARM64 CI jobs.
- Bug 2079416 - Update the wycheproof testvectors README.
- Bug 2079416 - Update ML-KEM wycheproof testvectors.
- Bug 2079416 - Update ML-DSA wycheproof testvectors.
- Bug 2079416 - Update DSA wycheproof testvectors.
- Bug 2079416 - Update RSA PKCS#1 v1.5 signature wycheproof testvectors.
- Bug 2079416 - Update RSA-PSS wycheproof testvectors.
- Bug 2079416 - Update RSA PKCS#1 v1.5 decryption wycheproof testvectors.
- Bug 2079416 - Update RSA-OAEP wycheproof testvectors.
- Bug 2079416 - Update EdDSA wycheproof testvectors.
- Bug 2079416 - Update ChaCha20-Poly1305 wycheproof testvectors.
- Bug 2079416 - Update ECDSA wycheproof testvectors.
- Bug 2079416 - Update ECDH wycheproof testvectors.
- Bug 2079416 - Update X25519 wycheproof testvectors.
- Bug 2079416 - Update HMAC wycheproof testvectors.
- Bug 2079416 - Update AES-CMAC wycheproof testvectors.
- Bug 2079416 - Update AES-CBC wycheproof testvectors.
- Bug 2079402 - read JSON directly for all wycheproof tests.
- Bug 2079457 - explicitly reject RSA PKCS#1 v1.5 ciphertexts that are not less than the modulus.
- Bug 2075179 - finalize the PRAGMA table_info statement on error paths in sdb_init.
- Bug 2076062 - Limit nesting depth in PKCS#12 safeContents decoder.
- Bug 2072757 - use encoded serial number to look up trust in fill_CERTCertificateFields.
- Bug 2077359 - remove unused SEC_ASN1_MKSUB from secsign.c.
- Bug 1961826 - Run NSS_Shutdown at exit in SMIME fuzzer.
- Bug 1961826 - Add streaming decoder pass to SMIME fuzzer.
- Bug 1961826 - Verify SignerInfos in SMIME fuzzer.
- Bug 1961826 - Regenerate test certs for SMIME fuzzer.
- Bug 1961826 - Add EC cert for ECDH and decrypt key callback to SMIME fuzzer.
- Bug 1961826 - Extend the SMIME fuzzer to cover more functions.
- Bug 390374 - return NULL for deprecated PBE functions.
- Bug 2061403 - Keep sigd->digests parallel to sigd->digestAlgorithms.
- Bug 2076696 - guard against integer overflow in PK11_HPKE_Seal and PK11_HPKE_Open.
- Bug 2076037 - ensure chacha20-poly1305 tag buffer is 16 bytes in PK11_AEADOp.
- Bug 2077359 - remove more unused functions from NSS.
- Bug 1960284 - Don't report epoch exhaustion through FatalError.
:::