.. _mozilla_projects_nss_nss_3_125_release_notes: NSS 3.125 release notes ======================= `Introduction <#introduction>`__ -------------------------------- .. container:: Network Security Services (NSS) 3.125 was released on *11 June 2026*. `Distribution Information <#distribution_information>`__ -------------------------------------------------------- .. container:: The HG tag is NSS_3_125_RTM. NSS 3.125 requires NSPR 4.38.2 or newer. NSS 3.125 source distributions are available on ftp.mozilla.org for secure HTTPS download: - Source tarballs: https://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/NSS_3_125_RTM/src/ Other releases are available :ref:`mozilla_projects_nss_releases`. .. _changes_in_nss_3.125: `Changes in NSS 3.125 <#changes_in_nss_3.125>`__ ------------------------------------------------------------------ .. container:: - Bug 2031345 - Set nssckbi version to 2.88. - Bug 2032612 - Add Cybertrust Japan SecureSign Root CA16. - Bug 2031314 - Remove Email Trust bit from TrustAsia Global Root CA G3 and G4. - Bug 2032223 - Remove Entrust Root Certification Authority. - Bug 2031105 - Remove SecureSign Root CA12. - Bug 1867436 - Initialize ssl3.hs.echOuterExtensions in ssl_NewSocket. - Bug 2046220 - replace references to nss-dev/nss with mozilla/nss. - Bug 2023208 - limit recursion depth in CMS decoder. - Bug 2027353 - clamp input.len to testString size in pk11_mergeSecretKey. - Bug 2030561 - NULL pointer dereference in CERT_MergeExtensions. - Bug 2028954 - CERT_DecodeAVAValue — Integer Overflow in Output Buffer Sizing. - Bug 2032110 - fix two integer overflows on LLP64 systems. - Bug 2045688 - Modify an assertion in ssl3_ClientSendAppProtoXtn. - Bug 2044917 - Import RSA-PSS PKCS#8 private keys. - Bug 2035521 - Add EC Derive fuzz target. - Bug 2035522 - Update fuzz/config/tstclnt_arguments.py. - Bug 2030915 - Add DSAU fuzz target. - Bug 2031320 - Update ASN1 mutators for fuzzing. - Bug 2031319 - Update TLS mutators for fuzzing. - Bug 2031325 - Update TLS certs for fuzzing. - Bug 2031322 - Update TLS config for fuzzing. - Bug 2035502 - Extend QuickDER fuzz target. - Bug 2035501 - Extend PKCS12 fuzz target. - Bug 2035499 - Extend PKCS8 fuzz target. - Bug 2031792 - Extend certDN fuzz target. - Bug 2031790 - Update ASN1 fuzz target. - Bug 2031323 - Extend PKCS7 fuzz target. - Bug 2029433 - Bounds-check wrap index in PK11_GetWrapKey to match PK11_SetWrapKey. - Bug 2029407 - Adding a guard against integer overflow in AESKeyWrap_EncryptKWP. - Bug 2027376 - Add an integer overflow guard in UpdateBase64Decoder. - Bug 2032552 - Void out the fd.release in reconfig tests. - Bug 2029922 - make sftk_FindAttribute return a copy. - Bug 1652123 - Converted nss parameter schema from voluptuous to msgspec. - Bug 311577 - drop slot monitor in PK11_ResetToken before calling PK11_InitToken. - Bug 2042949 - adjust the code to use nspr from github. - Bug 1885900 - avoid deadlock when PK11_IsLoggedIn is called from PK11_DoPassword. - Bug 2044134 - test pk11auth.c functions with a non-threadsafe module. - Bug 311577 - PK11_InitPin sets slot->lastLoginCheck without holding the slot monitor. - Bug 2027349 - reject empty nickname in PK11_TraverseCertsForNicknameInSlot. - Bug 2027346 - validate encoded EC params length and tag in SECKEY_ECParamsToKeySize/BasePointOrderLen. - Bug 2027373 - guard space subtraction in ssl_CallCustomExtensionSenders. - Bug 2027371 - rewrite labelLen bound in tls13_HkdfExpandLabelGeneral to avoid unsigned overflow. - Bug 2027362 - bound usageCount in PK11_UnwrapPrivKey to keyTemplate capacity. - Bug 2027364 - Set tail pointer to null in static slot lists when deallocating. - Bug 2030102 - avoid leaving a dangling ss->sec.ci.sid on allocation failure. - Bug 2043887 - guard against integer overflow in CERT_Hexify. - Bug 2029453 - Reject empty SECItem inputs in sftk_IsSafePrime before indexing data[len-1]. - Bug 2029757 - NUL-terminate within filename field in jar_listtar to bound the filename scan. - Bug 2029748 - Widen CERT_FormatName length accumulator from unsigned to size_t. - Bug 2029796 - Bound IKE PRF nonce lengths to prevent CK_ULONG to unsigned int truncation. - Bug 2029797 - Drop companion arrays on length mismatch in NSS_CMSArray_Sort instead of asserting. - Bug 2029798 - Operate on a NUL-terminated copy in jar_parse_any to keep manifest scans bounded. - Bug 2029778 - Reject MD2 contexts with unusedBuffer > MD2_BUFSIZE in Update and End. - Bug 2029791 - Reserve NUL terminator for CKA_NSS_URL in nssCKObject_GetAttributes. - Bug 2029807 - Guard padding read against empty output in SEC_PKCS7DecryptContents. - Bug 2029901 - Guard against keySize overflow in IKE PRF/PRF+ output sizing. - Bug 2030109 - Allocate values array when overwriting an empty CMS attribute. - Bug 2030559 - Validate CKA_TOKEN attribute size in nssCKFWObject_SetAttribute. - Bug 2030563 - Validate CKA_CERTIFICATE_TYPE ulValueLen in nss_cert_type_from_ck_attrib. - Bug 2030566 - Handle zero-length input in PrepareBitStringForEncoding. - Bug 2030571 - Length-check raw_manifest before PORT_Strncasecmp prefix dispatch in JAR_parse_manifest. - Bug 2031902 - Reject CKA_NSS_MODULE_SPEC values that aren't NUL-terminated within ulValueLen. - Bug 2031903 - Reject negative PR_Read returns in JAR_digest_file and jar_create_pk7. - Bug 2041240 - Update Bogo tests to 3fff7111b0eca817466e121059cb4e8b67ade35b. - Bug 2043243 - doc: import NSS:TryServer wiki page in the tree. - Bug 2033664 - improve PK11 URI tests. - Bug 2037205 - avoid nested attributeLock acquisition in sftk_CopyObject. - Bug 2038536 - doc: fix a typo in "Community — Network Security Services (NSS)". - Bug 2037205 - acquire RWLock before key copies in ssl_SetSelfEncryptKeyPair. - Bug 2027325 - Reject empty nickname in PK11_TraverseCertsForNicknameInSlot. - Bug 1767921 - require non-null session pointer in sftk_GetContext. - Bug 1767921 - set session->lastOpWasFIPS while holding session reference. - Bug 1767921 - atomically claim object removal in sftk_DeleteObject. - Bug 1767921 - atomically swap session search in NSC_FindObjects*. - Bug 1767921 - atomically install session contexts in C_*Init. - Bug 1767921 - hold session reference for context lifetime in C_*Update. - Bug 1767921 - align softoken session lock with head-bucket hash. - Bug 1767921 - restore reference counting for SFTKSession.