Release Date: 20 October 2026
Advanced notice of changes scheduled for after 2026.LTS
Read moreNew features and improvements
Server
Platforms
- Ubuntu 2026.04 LTS is now a supported platform for self-managed production environments.
Security
- Dynamic Row-Level Security via ABAC User Tags in PBAC: you can now reference Attribute-Based Access Control (ABAC) user tags inside Property-Based Access Control (PBAC) rules using abac.native.user_tags(). This enables a capability similar to dynamic Row-Level Security (RLS) in relational databases by restricting access based on whether an element’s property matches the authenticated user’s tags.
Example:
GRANT TRAVERSE ON GRAPH *
FOR (n:Project) WHERE n.department IN abac.native.user_tags()
TO projectTeam
Limitation: Negation unsupported: Unlike standard IN expressions, predicates using abac.native.user_tags() cannot be negated with NOT.
Documentation references: For syntax and configuration examples, see Operations Manual → Grant a property-based privilege using native user tags. For handling denials and restrictions, see Operations Manual → Negation and DENY with abac.native.user_tags().
Language
Cypher 25
- Improve the concurrency of CALL { … } IN CONCURRENT TRANSACTIONS DISJOINT BY transaction batch scheduling with resource access conflicts between batches.
- Profiling a CALL { … } IN CONCURRENT TRANSACTIONS subquery now reports the levels of concurrency achieved. See the Cypher Manual -> Measuring concurrency with PROFILE.
- Added a parameter to db.schema.visualization() to eliminate ghost relationships, at the cost of some performance. See Operations Manual -> Procedures for details.
- Introduced map addition, allowing maps to be merged using the plus operator; RETURN map1 + map2. See the Cypher Manual -> Merging MAP values.
- Added the capability to combine SHOW CURRENT USER command with regular Cypher that can be run against the system database, for example, SHOW DATABASES and SHOW TRANSACTIONS. To ensure the command is run against the system database, prepend it with the USE clause. See Operations Manual – Manage users for details.
Deprecations
Server
- Procedures db.index.fulltext.queryNodes and db.index.fulltext.queryRelationships are deprecated.
Bug fixes
Server
Clustering
- when migrating the causal_clustering.load_balancing.config.server_policies configuration setting do not duplicate server_policies in the resulting migrated configuration.
- –type=AUTO backups with –prefer-diff-as-parent now try to base a differential on a more recent full backup when transaction logs have been pruned, instead of going straight to a new full backup.
Security
- Fix CVE-2026-89425, CVE-2026-91776 and CVE-2026-91777
- Fix CVE-2026-77420, CVE-2026-89044, CVE-2026-93488, CVE-2026-104721, CVE-2026-89407, CVE-2026-89425
- Bump Jline from 3.29.0 to 3.30.15 to fix CVE-2026-77420.
- Bump Jetty to 12.1.13.
Admin
- neo4j-admin server migrate-configuration now migrates routing DSL to tags.
Scalability
Infinigraph
- Resolved a write performance degradation issue when using a secondary graph shard.
Language
Cypher 25
- Fixed an issue where dividing the minimum 64-bit integer (-9223372036854775808) by -1 silently returned an incorrect result due to integer overflow. Cypher now correctly detects this condition and raises an arithmetic overflow error (22N28), ensuring consistent overflow handling across integer arithmetic operations.ì
Bundled products
The following products have been included in the distribution – available in /products directory unless stated otherwise – and are fully compatible with this release.- APOC Core 2026.10.0 – The most popular community library developed for the database, is fully supported (included in Labs directory).
- Bloom 6.x-2.37.1 – A beautiful and expressive data visualization tool to quickly explore and interact with Neo4j’s graph data platform – no coding required. Please refer to the release notes for details. (Requires a License)
- Browser 2026.10.14+0 – Neo4j Browser is a tool for developers to interact with the graph. It is the default interface for both Enterprise and Community Editions of the Neo4j database.
- Advanced notice of upcoming changes
- Since Neo4j 2025.08 the new browser moved out of preview and became our default experience with the legacy browser kept available to return to. With the next upcoming release (Neo4j 2026.11.0) the legacy browser will be removed and no longer part of the distribution.
- Advanced notice of upcoming changes
- Neo4j GenAI Plugin 2026.0X.0 – Neo4j’s GenAI plugin provides functions and procedures to interact with external AI providers through Cypher, such as for creating vector embeddings and generating text.
- Neo4j Graph Data Science 2026.10.0 is a compatible version of the connected data analytics and machine learning platform that helps you understand the connections in big data to answer critical questions and improve predictions. Please refer to the release notes for further details. (GDS Enterprise requires a License. )
- Enterprise Fleet Management is no longer bundled with the DBMS package as it is now included in Neo4j.
- Neo4j Ops Manager 1.15.6 is a UI-based tool that enables Administrators to operate and observe all of their Neo4j Database Management Servers. Now includes support for Neo4j’s any-to-any upgrade. Please refer to the release notes for details. (Included in Enterprise).
Advanced notice of upcoming changes
Query Log Default Format
The default query log format for new installations will change after the next Long Term Support (LTS) release. At the moment, it is set to PLAIN format by default. From the release after the next LTS, the default will be JSON format. If you are upgrading and preserving your current server-logs.xml file, then there will be no change, as support for PLAIN will remain, only the default value for new installations is changing. We recommend moving to JSON for query logging as it contains more information, though the resulting log file size will increase.High_limit store format
Heads-up: High_limit store format removal after the next LTS The High_limit store format was deprecated in Neo4j 5.23. The upcoming long-term support (LTS) release will be the final version to support reading, writing, and migrating High_limit databases. Beyond that LTS, Neo4j will not start if it detects a High_limit store. Please take note of the following:- The next LTS is the last supported migration window. Reading, writing, and migrating High_limit databases remains supported until the next LTS release only.
- Databases using the High_limit format will fail to start after the next LTS. No fallback or compatibility layer will be available.
- Migration to the Block format is required before upgrading beyond the next LTS. We strongly recommend planning and completing your offline migration during or prior to your upgrade to that LTS release.
Default Password Policy
After the next LTS release, we are increasing the default minimum password length for native database users from 8 characters to 16 characters.Why are we making this change?
At Neo4j, we take the security of your data seriously. Password length is one of the most effective tools for keeping accounts secure. This update aligns Neo4j with modern security best practices and recommendations from standards bodies like NIST.Who is impacted?
You will not be affected by this change if:- You’ve set the configuration setting dbms.security.auth_minimum_password_length to a value, so that the default settings are not used.
- You use modern 16+ character secure passwords already as part of your security measures.
- You manage user authentication through an external OIDC SSO or LDAP provider rather than native database users.
What about existing native users?
Existing native database users will not be impacted. Your current passwords will continue to work without interruption. The new 16-character minimum will only be enforced in the following scenarios:- When creating a new native database user.
- When changing or resetting the password for an existing native database user.