Trust Center

What happened
On October 21–24, 2026, a critical vulnerability was disclosed in the Brotli decompression library. It is tracked as CVE-2026-111497 and is also known as Node2Shell, HTTP2Shell and Broccoli2Shell. The flaw is an out-of-bounds write that can be triggered by crafted Brotli-compressed data. Depending on the software involved, it can cause a crash, memory disclosure or, in some circumstances, remote code execution. It affects a range of runtimes and libraries, including Node.js, Bun and Python packages.

Current status

• Customer impact: We assess that the vulnerability does not directly affect our software, but we understand that users may be affected due to components they may have/use in their infrastructure.
• Remediation: In progress.
• Customer action required: None at this time

 What you should do
If you run your own software that decompresses Brotli data from untrusted sources, we recommend updating affected components (Node.js, Bun, Python brotli/brotlicffi and others) to patched versions, and checking for bundled copies of the decoder in containers and third-party applications.

Overview
A vulnerability was identified regarding digital certificates issued by the eMudhra Certificate Authority, detailed in CVE-2026-111943 and CVE-2026-91403.

Review the Knowledge base article for full details: https://support.neo4j.com/s/article/Security-Statement-EMUDHRA-CVE-2026-111943

Impact and Status by Neo4j

Product
Self-Managed Enterprise Edition Databases
Neo4j self-managed database products are not directly vulnerable. However, self-managed customers are strongly advised to update their host operating systems and Java Virtual Machines (JVMs) to the latest patch releases to incorporate upstream root store fixes.
Containers and Docker Images
We have updated new Container images for all supported versions that ship base OS packages or bundled Java JDKs.

Neo4j Aura
All Aura products and services are updated (release 2026.10.1) to remove vulnerable eMudhra certificates across all production environments.

Neo4j Desktop

Review the Knowledge base article for information on recommended workarounds: https://support.neo4j.com/s/article/Fixing-CA-in-Neo4j-Desktop-CVE-2026-111943-CVE-2026-91403

This article contains an interim solution to help customers to continue to use Neo4j Desktop in a safe manner, a full solution product fix will be released in the near future.

Customers have asked whether their Neo4j AuraDB instances or self-managed deployments are impacted by the recent PHP2SHELL vulnerabilities. This notice applies to all Aura platform products and features, as well as self-managed Neo4j, including Enterprise Edition and Community Edition. PHP runtime is not deployed in any Neo4j products and services, and therefore users are not impacted. The Neo4j website is also not vulnerable. No action is required.

Neo4j has issued a 2025 Aura Virtual Dedicated Cloud Security Whitepaper. This white paper provides detailed insight into Neo4j Aura’s single-tenancy architecture. It focuses on security controls, features and an overview of our comprehensive approach to information security.

Neo4j has issued a 2025 Information Security Whitepaper. This whitepaper provides an introduction to the Neo4j information security program. It describes how our security program protects Neo4j as a company, and the data entrusted to us.

During a recent routine internal review of Neo4j AuraDB, the engineering team discovered that some configuration changes had affected the capture of Activity Feed logging events within the Neo4j Aura Console Service. This occurred between June 1 and July 1, 2026.

As background: on June 1, 2026, an internal and planned Neo4j configuration change caused a small number of Activity Feed logging events to be dropped. On June 23, 2026, a further change increased this amount, but the issue was resolved on July 1, 2026, following a service update.

While some Activity Feed logging data generated during this timeframe is unfortunately unrecoverable, there is no evidence that any data has been disclosed or accessed by any unauthorized third party, nor that any Neo4j system has been compromised. Furthermore, there is no evidence that this issue affected any Database Security log data, as these are captured using a different mechanism. Please also note that no action is required by users as a result of this issue.

Neo4j takes these issues seriously, and we are continually reviewing our monitoring and alerting processes so as to detect issues early and address them promptly. While we apologize for any inconvenience this issue may have caused, please be assured that protecting your data is our top priority.

If you have any additional questions, please contact your Neo4j representative.