(mozilla-projects-nss-nss-3-116-release-notes)=

# NSS 3.116 release notes

## [Introduction](#introduction)

:::{container}
Network Security Services (NSS) 3.116 was released on *11 September 2025\**.
:::

## [Distribution Information](#distribution_information)

:::{container}
The HG tag is NSS_3_116_RTM. NSS 3.116 requires NSPR 4.36 or newer. The latest version of NSPR is 4.37.

NSS 3.116 source distributions are available on ftp.mozilla.org for secure HTTPS download:

- Source tarballs:
  <https://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/NSS_3_116_RTM/src/>

Other releases are available {ref}`mozilla_projects_nss_releases`.
:::

(changes-in-nss-3-116)=

## [Changes in NSS 3.116](#changes_in_nss_3.116)

:::{container}

- Bug 1983308 - disable DSA in NSS script tests.
- Bug 1983308 - Disabling of some algorithms: generic cert.sh.
- Bug 1981046 - Need to update to new mechanisms.
- Bug 1983320 - Add ML-DSA public key printing support in NSS command-line utilities.
- Bug 1986802 - note embedded scts before revocation checks are performed.
- Bug 1983320 - Add support for ML-DSA keys and mechanisms in PKCS#11 interface.
- Bug 1983320 - Add support for ML-DSA key type and public key structure.
- Bug 1983320 - Enable ML-DSA integration via OIDs support and SECMOD flag.
- Bug 1983308 - disable kyber.
- Bug 1965329 - Implement PKCS #11 v3.2 PQ functions (use verify signature).
- Bug 1983308 - Disable dsa - gtests.
- Bug 1983313 - make group and scheme support in test tools generic.
- Bug 1983770 - Create GH workflow to automatically close PRs.
- Bug 1983308 - Disable dsa - base code.
- Bug 1983308 - Disabling of some algorithms: remove dsa from pk11_mode.
- Bug 1983308 - Disable seed and RC2 bug fixes.
- Bug 1982742 - restore support for finding certificates by decoded serial number.
- Bug 1984165 - avoid CKR_BUFFER_TO_SMALL error in trust lookups.
- Bug 1983399 - lib/softtoken/{sdb.c,sftkdbti.h}: Align sftkdb_known_attributes_size type.
- Bug 1965329 - Use PKCS #11 v3.2 KEM mechanisms and functions.
:::
