diff --git a/packages/security/nspr/package.mk b/packages/security/nspr/package.mk
index 8cde559e35..59678d0593 100644
--- a/packages/security/nspr/package.mk
+++ b/packages/security/nspr/package.mk
@@ -19,7 +19,7 @@
 ################################################################################
 
 PKG_NAME="nspr"
-PKG_VERSION="4.13.1"
+PKG_VERSION="4.19"
 PKG_ARCH="any"
 PKG_LICENSE="Mozilla Public License"
 PKG_SITE="http://www.linuxfromscratch.org/blfs/view/svn/general/nspr.html"
diff --git a/packages/security/nss/package.mk b/packages/security/nss/package.mk
index 032b686ef4..f8f7df98c4 100644
--- a/packages/security/nss/package.mk
+++ b/packages/security/nss/package.mk
@@ -19,12 +19,12 @@
 ################################################################################
 
 PKG_NAME="nss"
-PKG_VERSION="3.29.5"
-PKG_SHA256="8cb8624147737d1b4587c50bf058afbb6effc0f3c205d69b5ef4077b3bfed0e4"
+PKG_VERSION="3.37.1"
+PKG_SHA256="5ac4a388b06b2785fb7f4f0ae3c909d8cbb2ab370147ff61fe2517cc5bf3c685"
 PKG_ARCH="any"
 PKG_LICENSE="Mozilla Public License"
 PKG_SITE="http://ftp.mozilla.org/"
-PKG_URL="http://ftp.mozilla.org/pub/security/nss/releases/NSS_3_29_5_RTM/src/nss-3.29.5-with-nspr-4.13.1.tar.gz"
+PKG_URL="http://ftp.mozilla.org/pub/security/nss/releases/NSS_3_37_1_RTM/src/nss-3.37.1-with-nspr-4.19.tar.gz"
 PKG_DEPENDS_HOST="nspr:host zlib:host"
 PKG_DEPENDS_TARGET="toolchain nss:host nspr zlib sqlite"
 PKG_SECTION="security"
diff --git a/packages/security/nss/patches/nss-02_3.15.5-standalone-1.patch b/packages/security/nss/patches/nss-02_3.15.5-standalone-1.patch
index 4e3217806e..b82c25d0d8 100644
--- a/packages/security/nss/patches/nss-02_3.15.5-standalone-1.patch
+++ b/packages/security/nss/patches/nss-02_3.15.5-standalone-1.patch
@@ -237,5 +237,5 @@ Description:             Adds auto-generated nss.pc and nss-config script, and a
  
  RELEASE = nss
  
--DIRS = coreconf lib cmd gtests
+-DIRS = coreconf lib cmd cpputil gtests
 +DIRS = coreconf lib cmd config
diff --git a/packages/security/nss/patches/nss-03_gcc7.patch b/packages/security/nss/patches/nss-03_gcc7.patch
deleted file mode 100644
index 5f17718ad3..0000000000
--- a/packages/security/nss/patches/nss-03_gcc7.patch
+++ /dev/null
@@ -1,42 +0,0 @@
-From a1d2ef6a8e1bc721e44640bdb85747deaf8edcca Mon Sep 17 00:00:00 2001
-From: Khem Raj <raj.khem@gmail.com>
-Date: Wed, 19 Apr 2017 10:50:37 -0700
-Subject: [PATCH] Fix warnings found with gcc7
-
-GCC7 finds more type conversion issues
-
-| pkix_pl_ocsprequest.c: In function 'pkix_pl_OcspRequest_Hashcode':
-| pkix_pl_ocsprequest.c:92:60: error: '<<' in boolean context, did you mean '<' ? [-Werror=int-in-bool-context]
-|          *pHashcode = (((((extensionHash << 8) || certHash) << 8) ||
-|                         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~
-| pkix_pl_ocsprequest.c:93:27: error: '<<' in boolean context, did you mean '<' ? [-Werror=int-in-bool-context]
-|          *pHashcode = (((((extensionHash << 8) || certHash) << 8) ||
-|                       ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-|                  dateHash) << 8) || signerHash;
-|                  ~~~~~~~~~~^~~~~
-| cc1: all warnings being treated as errors
-
-Upstream-Status: Pending
-
-Signed-off-by: Khem Raj <raj.khem@gmail.com>
----
- nss/lib/libpkix/pkix_pl_nss/pki/pkix_pl_ocsprequest.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/nss/lib/libpkix/pkix_pl_nss/pki/pkix_pl_ocsprequest.c b/nss/lib/libpkix/pkix_pl_nss/pki/pkix_pl_ocsprequest.c
-index 171a3d2..d5eef88 100644
---- a/nss/lib/libpkix/pkix_pl_nss/pki/pkix_pl_ocsprequest.c
-+++ b/nss/lib/libpkix/pkix_pl_nss/pki/pkix_pl_ocsprequest.c
-@@ -89,7 +89,7 @@ pkix_pl_OcspRequest_Hashcode(
-         PKIX_HASHCODE(ocspRq->signerCert, &signerHash, plContext,
-                 PKIX_CERTHASHCODEFAILED);
- 
--        *pHashcode = (((((extensionHash << 8) || certHash) << 8) ||
-+        *pHashcode = ((PKIX_UInt32)(((PKIX_UInt32)((extensionHash << 8) || certHash) << 8) ||
-                 dateHash) << 8) || signerHash;
- 
- cleanup:
--- 
-2.12.2
-
-
diff --git a/packages/security/nss/patches/nss-06-always-include-fstar.patch b/packages/security/nss/patches/nss-06-always-include-fstar.patch
new file mode 100644
index 0000000000..3490e6f3f8
--- /dev/null
+++ b/packages/security/nss/patches/nss-06-always-include-fstar.patch
@@ -0,0 +1,20 @@
+diff --git a/nss/lib/freebl/Makefile b/nss/lib/freebl/Makefile
+index e6a94d35c..0c714c85c 100644
+--- a/nss/lib/freebl/Makefile
++++ b/nss/lib/freebl/Makefile
+@@ -535,12 +535,14 @@ ifeq (,$(filter-out i386 x386 x86 x86_64 aarch64,$(CPU_ARCH)))
+     # All intel architectures get the 64 bit version
+     # With custom uint128 if necessary (faster than generic 32 bit version).
+     ECL_SRCS += curve25519_64.c
+-    VERIFIED_SRCS += Hacl_Curve25519.c FStar.c
++    VERIFIED_SRCS += Hacl_Curve25519.c
+ else
+     # All non intel architectures get the generic 32 bit implementation (slow!)
+     ECL_SRCS += curve25519_32.c
+ endif
+
++VERIFIED_SRCS += FStar.c
++
+ #######################################################################
+ # (5) Execute "global" rules. (OPTIONAL)                              #
+ #######################################################################