Snapshot 218500
Raw (normalized text)
Scripts and page chrome removed; this is what change detection compares.
Trust Center Start your security review View & download sensitive information Ask for information Overview Welcome to Neo4j's Trust Center. Our commitment to data privacy and security is embedded in every part of our business. Use this Trust Center to learn about our security posture and request access to our security documentation. Compliance ISO/IEC 27001:2022 SOC 2 Type 2 SOC 3 CSA STAR Level 1 GDPR CCPA HIPAA ISO 9001:2015 ISO/IEC 20243:2024 NIST AI RMF ISO/IEC 27017:2015 ISO/IEC 27018:2019 TX-RAMP Compliance Documents Featured Documents COMPLIANCE DOCUMENTSInformation Security Whitepaper COMPLIANCE DOCUMENTSNeo4j Sweden AB 2025 Sustainability Report PRODUCT SECURITYNeo4j Aura White-Paper for Dedicated Environments COMPLIANCECSA STAR Level 1 REPORTSCore DB Pentest Report COMPLIANCESOC 3 COMPLIANCESOC 2 Type 2 REPORTSAura Pentest Report POLICIESInformation Security Policy COMPLIANCE DOCUMENTSNeo4j Aura White-Paper for Standard Environments REPORTSVPAT Accessibility Conformance Report POLICIESNeo4j AI Governance Policy Product Security Audit Logging Neo4j Aura White-Paper for Dedicated Environments Reports HIPAA Report Core DB Pentest Report ACR (VPAT) Enterprise Studio (2026) View more App Security Responsible Disclosure Application Penetration Testing Code Analysis View more AI AI Risk Management AI Governance Responsible AI Statement Legal Subprocessors Cyber Insurance Data Processing Agreement View more Data Privacy Data Privacy Officer Data Protection Impact Assessment (DPIA) Employee Privacy Training View more Access Control Access Log Management Data Access Device Lock View more Infrastructure Status Monitoring Amazon Web Services Azure View more Endpoint Security Anti-Malware Disk Encryption DNS Filtering View more Policies Neo4j IT AUP (internal) Neo4j AI Governance Policy Access Control Policy View more Incident Response Forensic Retainer Incident Reporting Process Security Operations Center (SOC) Training Employee Privacy Training Phishing Training Role-Based Training View more Physical & Environment Access Monitoring Alarms & Surveillance Fire Protection View more Knowledge Base (FAQ) Does Neo4j have a security program in place? How are vulnerabilities, such as CVEs, managed and responded to? How is data hosted in Neo4j Aura protected? Does Neo4j have a Responsible Disclosure Policy for security related issues? What is HIPAA and is Neo4j's AuraDB HIPAA certified? View more Trust Center Updates Security Advisory: Brotli Decoder Vulnerability (CVE-2026-111497) Vulnerabilities What happened On October 21–24, 2026, a critical vulnerability was disclosed in the Brotli decompression library. It is tracked as CVE-2026-111497 and is also known as Node2Shell, HTTP2Shell and Broccoli2Shell. The flaw is an out-of-bounds write that can be triggered by crafted Brotli-compressed data. Depending on the software involved, it can cause a crash, memory disclosure or, in some circumstances, remote code execution. It affects a range of runtimes and libraries, including Node.js, Bun and Python packages. Current status Customer impact: We assess that the vulnerability does not directly affect our software, but we understand that users may be affected due to components they may have/use in their infrastructure. Remediation: In progress. Customer action required: None at this time What you should do If you run your own software that decompresses Brotli data from untrusted sources, we recommend updating affected components (Node.js, Bun, Python brotli/brotlicffi and others) to patched versions, and checking for bundled copies of the decoder in containers and third-party applications. Neo4j Security Statement: eMudrah Certificate Authority Issue (CVE-2026-111943, CVE-2026-91403) Vulnerabilities Overview A vulnerability was identified regarding digital certificates issued by the eMudhra Certificate Authority, detailed in CVE-2026-111943 and CVE-2026-91403. Review the Knowledge base article for full details: https://support.neo4j.com/s/article/Security-Statement-EMUDHRA-CVE-2026-111943 Impact and Status by Neo4j Product Self-Managed Enterprise Edition Databases Neo4j self-managed database products are not directly vulnerable. However, self-managed customers are strongly advised to update their host operating systems and Java Virtual Machines (JVMs) to the latest patch releases to incorporate upstream root store fixes. Containers and Docker Images We have updated new Container images for all supported versions that ship base OS packages or bundled Java JDKs. Neo4j Aura All Aura products and services are updated (release 2026.10.1) to remove vulnerable eMudhra certificates across all production environments. Neo4j Desktop Review the Knowledge base article for information on recommended workarounds: https://support.neo4j.com/s/article/Fixing-CA-in-Neo4j-Desktop-CVE-2026-111943-CVE-2026-91403 This article contains an interim solution to help customers to continue to use Neo4j Desktop in a safe manner, a full solution product fix will be released in the near future. Neo4j Aura and Self-Managed Neo4j Not Impacted by PHP2SHELL (CVE-2026-109618 and CVE-2026-109619) Vulnerabilities Customers have asked whether their Neo4j AuraDB instances or self-managed deployments are impacted by the recent PHP2SHELL vulnerabilities. This notice applies to all Aura platform products and features, as well as self-managed Neo4j, including Enterprise Edition and Community Edition. PHP runtime is not deployed in any Neo4j products and services, and therefore users are not impacted. The Neo4j website is also not vulnerable. No action is required. Information Security Whitepaper General Neo4j has issued a 2025 Aura Virtual Dedicated Cloud Security Whitepaper. This white paper provides detailed insight into Neo4j Aura’s single-tenancy architecture. It focuses on security controls, features and an overview of our comprehensive approach to information security. Neo4j has issued a 2025 Information Security Whitepaper. This whitepaper provides an introduction to the Neo4j information security program. It describes how our security program protects Neo4j as a company, and the data entrusted to us. Neo4j Aura Console Service Incidents During a recent routine internal review of Neo4j AuraDB, the engineering team discovered that some configuration changes had affected the capture of Activity Feed logging events within the Neo4j Aura Console Service. This occurred between June 1 and July 1, 2026. As background: on June 1, 2026, an internal and planned Neo4j configuration change caused a small number of Activity Feed logging events to be dropped. On June 23, 2026, a further change increased this amount, but the issue was resolved on July 1, 2026, following a service update. While some Activity Feed logging data generated during this timeframe is unfortunately unrecoverable, there is no evidence that any data has been disclosed or accessed by any unauthorized third party, nor that any Neo4j system has been compromised. Furthermore, there is no evidence that this issue affected any Database Security log data, as these are captured using a different mechanism. Please also note that no action is required by users as a result of this issue. Neo4j takes these issues seriously, and we are continually reviewing our monitoring and alerting processes so as to detect issues early and address them promptly. While we apologize for any inconvenience this issue may have caused, please be assured that protecting your data is our top priority. If you have any additional questions, please contact your Neo4j representative. If you need help using this Trust Center, please contact us. Contact support If you think you may have discovered a vulnerability, please send us a note. Report issue Subprocessors