Neo4j 4.2
Neo4j 4.2
The Neo4j 4.2 reached end of service life on May 16, 2022 — Neo4j no longer ships security patches or fixes for it. Our third-party support keeps it safe to run: 24/7 engineers manage issues, remediate vulnerabilities, and help you maintain compliance.
24/7 engineers own your Neo4j 4.2 incidents end to end.
Mitigation and patch-around guidance when the vendor no longer ships fixes.
Controls evidence and documentation that keep auditors satisfied.
Specifications
- product
- neo4j
- release
- 4.2
- product Label
- Neo4j
- release Label
- 4.2
- codename
- lts
- latest Version
- 4.2.19
- release Date
- 2020-11-17
- maintained
- source Url
- https://endoflife.date/neo4j
Lifecycle Dates
- End of Service Life
- May 16, 2022
- Last OEM Support
- May 16, 2022
OEM vs. 3rd Party Support
See how third-party support compares to the vendor contract for Neo4j 4.2 — monitoring, break/fix, vulnerability work, operations and compliance, before and after EOSL.
| Feature | OEM Support | 3rd Party Support |
|---|---|---|
| Post-EOSL Support | ||
| Break/Fix Support | Until EOSL | |
| 24/7 Monitoring | ||
| Vulnerability Scanning & Remediation | ||
| Managed Operations | ||
| Procedure & Configuration Review | ||
| Compliance & Audit Documentation | Limited | |
| Discounted Migration to Other Platforms |
Why Choose 3rd Party Support for Neo4j 4.2?
Vulnerability Remediation
Scanning, mitigation and patch-around guidance for Neo4j 4.2 when the vendor no longer ships fixes.
Compliance Maintenance
Procedure review, controls evidence and the documentation auditors ask for — maintained continuously, not scrambled at audit time.
24/7 Expert Support
Engineers who know this release monitor, manage and fix issues around the clock — break/fix to managed operations.
Neo4j 4.2 Support: Frequently Asked Questions
Is the Neo4j 4.2 still supported?
Neo4j ended support for the Neo4j 4.2 on May 16, 2022 — no more patches or fixes from the vendor. Third-party support keeps it covered: our engineers manage issues, remediate vulnerabilities, and help you maintain compliance for as long as you run it.
When is the Neo4j 4.2 end of service life (EOSL) date?
Neo4j lists the end of service life for the Neo4j 4.2 as May 16, 2022.
Can I keep using the Neo4j 4.2 after its EOSL date?
Yes. EOSL means Neo4j stops issuing patches and support — the software itself keeps running. Third-party support covers it from there: issue management, security vulnerability remediation, and the compliance documentation auditors ask for, for as long as you choose to run it.
How much does third-party support for the Neo4j 4.2 cost?
Typically 40-70% below the OEM maintenance renewal price. Exact pricing depends on quantity, service level and location — request a quote and we respond within 24 hours.
Known Vulnerabilities Affecting Neo4j 4.2
4 published CVEs affect the Neo4j 4.2. Neo4j no longer ships security patches for this release — our engineers provide mitigation guidance, workarounds and hardening support.
| CVE | Severity | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-1524 | LOW | 2.1 | Mar 11, 2026 | An edgecase in SSO implementation in Neo4j Enterprise edition versions prior to version 2026.02 can lead to unauthorised access under the following conditions: If a neo4j admin configures two or more OIDC providers AND configures one or more of them to be an authorization provider AND configures one or more of them to be authentication-only, then those that are authentication-only will also provide authorization. This edgecase becomes a security problem only if the authentication-only provider |
| CVE-2026-1471 | LOW | 2.1 | Mar 11, 2026 | Excessive caching of authentication context in Neo4j Enterprise edition versions prior to 2026.01.4 leads to authenticated users inheriting the context of the first user who authenticated after restart. The issue is limited to certain non-default configurations of SSO (UserInfo endpoint). We recommend upgrading to versions 2026.01.4 (or 5.26.22) where the issue is fixed. |
| CVE-2026-1497 | LOW | 2.0 | Mar 11, 2026 | Incorrect resolving of namespaces in composite databases in Neo4j Enterprise edition prior to versions 2026.02 and 5.26.22 can lead to the following scenario: an admin that intends to give a user an access to a remote database constituent "namespace.name" will inadvertently grant access to any local database or remote alias called "name". If such database or alias doesn't exist when the command is run, the privileges will apply if it's created in the future. |
| CVE-2026-1337 | LOW | 1.1 | Feb 6, 2026 | Insufficient escaping of unicode characters in query log in Neo4j Enterprise and Community editions prior to 2026.01 can lead to XSS if the user opens the logs in a tool that treats them as HTML. There is no security impact on Neo4j products, but this advisory is released as a precaution to treat the logs as plain text if using versions prior to 2026.01. Proof of concept exploit: https://github.com/JoakimBulow/CVE-2026-1337 |