Neo4j 2026.x — End of Life
Active Critical riskNeo4j 2026.x is partially supported: only 2026.09 still receives security fixes. The most recent release in this series is 2026.09.0. 5 CVEs are tracked for this series, including 1 critical. 4 of them were published after the end of life of the affected cycle and will not get an official patch.
Neo4j 2026.x — All releases
| Version | Released | Active support | EOL date | Latest patch | Status | Alert me |
|---|---|---|---|---|---|---|
| 2026.09 | Sep 21, 2026 | — | No | 2026.09.0 | Active | |
| 2026.08 | Sep 10, 2026 | — | Sep 21, 2026 | 2026.08.1 | EOL | |
| 2026.07 | Aug 5, 2026 | — | Sep 10, 2026 | 2026.07.1 | EOL | |
| 2026.06 | Jul 8, 2026 | — | Jul 30, 2026 | 2026.06.0 | EOL | |
| 2026.05 | May 28, 2026 | — | Jul 8, 2026 | 2026.05.0 | EOL | |
| 2026.04 | Apr 23, 2026 | — | May 28, 2026 | 2026.04.0 | EOL | |
| 2026.03 | Apr 2, 2026 | — | Apr 23, 2026 | 2026.03.1 | EOL | |
| 2026.02 | Mar 20, 2026 | — | Apr 2, 2026 | 2026.02.3 | EOL | |
| 2026.01 | Feb 10, 2026 | — | Mar 6, 2026 | 2026.01.4 | EOL |
CVEs affecting Neo4j 2026.x (13)
| CVE | Severity | CVSS | EPSS | KEV | Cycle | Description | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-14587 | HIGH | 7.5 | 0.54% | — | 2026.05 | Neo4j's Bolt modern handshake decoder treats an overlong capability bit mask the same way it treats a truncated bit mask… | Aug 5, 2026 |
| CVE-2026-14587 | HIGH | 7.5 | 0.54% | — | 2026.04 | Neo4j's Bolt modern handshake decoder treats an overlong capability bit mask the same way it treats a truncated bit mask… | Aug 5, 2026 |
| CVE-2026-14587 | HIGH | 7.5 | 0.54% | — | 2026.02 | Neo4j's Bolt modern handshake decoder treats an overlong capability bit mask the same way it treats a truncated bit mask… | Aug 5, 2026 |
| CVE-2026-14587 | HIGH | 7.5 | 0.54% | — | 2026.07 | Neo4j's Bolt modern handshake decoder treats an overlong capability bit mask the same way it treats a truncated bit mask… | Aug 5, 2026 |
| CVE-2026-14587 | HIGH | 7.5 | 0.54% | — | 2026.01 | Neo4j's Bolt modern handshake decoder treats an overlong capability bit mask the same way it treats a truncated bit mask… | Aug 5, 2026 |
| CVE-2026-14587 | HIGH | 7.5 | 0.54% | — | 2026.06 | Neo4j's Bolt modern handshake decoder treats an overlong capability bit mask the same way it treats a truncated bit mask… | Aug 5, 2026 |
| CVE-2026-14587 | HIGH | 7.5 | 0.54% | — | 2026.03 | Neo4j's Bolt modern handshake decoder treats an overlong capability bit mask the same way it treats a truncated bit mask… | Aug 5, 2026 |
| CVE-2026-1524 | CRITICAL | 9.8 | 0.32% | — | 2026.01 | An edgecase in SSO implementation in Neo4j Enterprise edition versions prior to version 2026.02 can lead to unauthorised… | Mar 11, 2026 |
| CVE-2026-1524 | CRITICAL | 9.8 | 0.32% | — | 2026.02 | An edgecase in SSO implementation in Neo4j Enterprise edition versions prior to version 2026.02 can lead to unauthorised… | Mar 11, 2026 |
| CVE-2026-1471 | MEDIUM | 6.5 | 0.25% | — | 2026.01 | Excessive caching of authentication context in Neo4j Enterprise edition versions prior to 2026.01.4 leads to authenticat… | Mar 11, 2026 |
| CVE-2026-1497 | HIGH | 7.2 | 0.24% | — | 2026.02 | Incorrect resolving of namespaces in composite databases in Neo4j Enterprise edition prior to versions 2026.02 and 5.26.… | Mar 11, 2026 |
| CVE-2026-1497 | HIGH | 7.2 | 0.24% | — | 2026.01 | Incorrect resolving of namespaces in composite databases in Neo4j Enterprise edition prior to versions 2026.02 and 5.26.… | Mar 11, 2026 |
| CVE-2026-1337 | MEDIUM | 5.4 | 0.24% | — | 2026.01 | Insufficient escaping of unicode characters in query log in Neo4j Enterprise and Community editions prior to 2026.01 can… | Feb 6, 2026 |
Add a Neo4j 2026 EOL badge to your README
Show your users which Neo4j version your project runs and whether it is still supported. The badge updates automatically. More formats and options →
[](https://eolcanary.com/explore/neo4j/2026)Frequently asked questions
Is Neo4j 2026 end of life?
Partially. 8 of the 9 Neo4j 2026.x releases have reached end of life. Still supported: 2026.09.
What CVEs affect Neo4j 2026?
There are 5 CVEs tracked for Neo4j 2026.x, including 1 critical severity issue. See the full list above with CVSS and EPSS scores.
What is the latest Neo4j 2026 version?
The latest Neo4j 2026.x patch release is 2026.09.0, released on September 16, 2026. Always run the latest patch to benefit from all security fixes.
When was Neo4j 2026 first released?
Neo4j 2026.01 was released on February 10, 2026. See the full version timeline in the table above.
Is it safe to run Neo4j 2026 in production?
Only on a supported release (2026.09). Make sure you run the latest patch (2026.09.0) to have all security fixes applied.
Data sourced from endoflife.date · CVE data from NVD · EPSS from FIRST.org · KEV from CISA