The NSSCipherSuite option of modnss accepts OpenSSL-styled cipherstrings. It was found that the parsing of such cipherstrings is flawed. If this option is used to disable insecure ciphersuites using the common "!" syntax, e.g.:
NSSCipherSuite !eNULL:!aNULL:AESGCM+aRSA:ECDH+aRSA
it will actually enable those insecure ciphersuites.
Acknowledgements:
This issue was discovered Hubert Kario of Red Hat.