(mozilla-projects-nss-nss-3-129-release-notes)=

# NSS 3.129 release notes

## Introduction

:::{container}
Network Security Services (NSS) 3.129 was released on *9 September 2026*.
:::

## Distribution Information

:::{container}
The HG tag is NSS_3_129_RTM. NSS 3.129 requires NSPR 4.39 or newer.

NSS 3.129 source distributions are available on ftp.mozilla.org for secure HTTPS download:

- Source tarballs:
  <https://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/NSS_3_129_RTM/src/>

Other releases are available {ref}`mozilla-projects-nss-releases`.
:::

(changes-in-nss-3-129)=

## Changes in NSS 3.129

:::{container}
- Bug 2068788 - emit static library names during static build.
- Bug 2067434 - avoid building libcrux twice in makefile builds.
- Bug 2068010 - fix non-linux arm64 makefile builds.
- Bug 2017322 - set CKA_NSS_SERVER_DISTRUST_AFTER for CN=Izenpe.com.
- Bug 2057185 - Document ./mach try and its Mercurial-only caveat in CLAUDE.md.
- Bug 2056793 - Add tests for concurrent channel info queries during session replacement.
- Bug 2056793 - take the session cache lock when reading ss->sec.ci.sid.
- Bug 2066046 - Fix a race in STAN_GetNSSCertificate.
- Bug 2066591 - Remove write-only blLib and libraryName statics from freebl's lowhash_vector.
- Bug 2025246 - fix unknown key error type in ssl_SetAuthKeyBits.
- Bug 2065879 - re-vendor HACL* and simplify run_hacl.sh.
- Bug 2065879 - stop clang-formatting the vendored HACL* code.
- Bug 2068191 - add --dry-run to mach try to print job list.
- Bug 2029288 - avoid integer overflow in PK11_BlockData.
- Bug 2066960 - fix UB in ecperf.c.
- Bug 2067239 - Old coverity issues.
- Bug 2067237 - MLKEM mechinfo needs keys sizes.
- Bug 2066900 - pin NSPR 4.40 in CI.
- Bug 2066266 - ML-KEM-1024 incorrectly allows an explicit encapsulation seed.
- Bug 2066265 - Support for ML-KEM-512 in freebl and softoken.
- Bug 2060316 - remove support for pre-standard Kyber.
- Bug 2065423 - Build NSPR out of tree, into the dist directory.
- Bug 2065423 - Write a machine-readable summary.json for each test run.
- Bug 2065423 - Fail test runs on UBSan errors and on core dumps in debug builds.
- Bug 2065423 - Link tests_results/latest at the newest test run.
- Bug 2065423 - Resolve ssl_gtest_db.sh against QADIR.
- Bug 2065423 - Generate nss.pc and nss-config into the dist directory.
- Bug 2065423 - Add a --dist option to build.sh.
- Bug 2065219 - Update Cryptofuzz version.
- Bug 2056790 - Use PK11 digest contexts for explicit hashing in cryptohi.
:::