Release Date: 4 August 2026

Release Note for Neo4j 5.26.29 (4 August 2026)

Server

- Update log4j version to 2.26.1 to fix CVE-2026-49844
- Update Apache Shiro to 3.0.0 as the 2.x series is now EOL

- Introduce a setting dbms.cluster.raft.async_channel_acquisition_enabled, which defaults to false. When set to true, raft message sending is asynchronous and can help cases where unavailable members cause write delays. It is recommended to set this to true in environments like Kubernetes or where there are ‘man-in-the-middle’ proxies or network layers. Note that this is not new functionality; this setting exposes an internal setting publicly and has been available in the Calver releases since 2025.02.

- Fixed Memory Errors and Incorrect Counts in Composite Database Subqueries
- The Issue: When you passed an outside variable into a CALL subquery on a composite database, Neo4j was mistakenly injecting that variable into every WITH clause inside the subquery.
- The Impact: This caused two major problems for aggregations (like count(*)). Neo4j accidentally treated the injected variable as a “grouping key,” which is used to divide aggregated data into different buckets. First, if your variable was a massive list (like the 100,000 numbers in the example), the database vastly overestimated the memory needed to build those buckets. It preemptively killed the query to avoid an Out Of Memory (OOM) error. Second, if your query found no data, this buggy grouping caused it to return an empty result instead of correctly returning a count of 0.
- The Fix: Cypher no longer incorrectly forces these outer dependencies into your aggregations. Your queries will no longer be rejected due to fake memory spikes, and empty counts will return 0 correctly.
- Eg.

USE composite.constituent WITH range(1, 100000) AS big

CALL (big) {

UNWIND range(1, 1000) AS i

MATCH (:NoExistentLabel) // or WITH * WHERE predicateEvaluatingToFalse

WITH count(*) AS c

RETURN c

} RETURN c

- Fix error classification of “create relationship %s, node %s is missing” from database error to client error.
- Fixed a bug where EXISTS expression nested in a quantified path pattern would trigger a class cast exception.

Please refer to the changelog for full details of the changes.

See All Database Releases →