Self-hosted Dgraph v25 administrators should update now. GitHub published a critical Dgraph security advisory on August 20, 2026. The advisory identifies Dgraph v25 releases through 25.3.4 as affected and lists 25.3.5 as the corrected release.
This is defensive maintenance guidance for database and platform teams. It intentionally avoids technical attack detail. Use the official advisory and Dgraph release notes to confirm scope and complete the update through your approved operating process.
Who Should Review This Advisory
- Teams operating self-hosted Dgraph v25 servers.
- Platform teams responsible for graph-database availability and application dependencies.
- Hosting and managed-service teams that administer Dgraph for customers.
Update Dgraph Safely
- Identify Dgraph v25 instances and confirm their installed release, service owner, workload dependencies, and maintenance window.
- If an instance is on 25.3.4 or earlier, plan the update to 25.3.5 or later using the official Dgraph release guidance.
- Use normal change control, including an approved recovery path and a named owner for application validation. Do not create or alter a backup schedule solely for this update.
- Test the planned version change against representative application workflows where a non-production environment is available.
- Apply the release through the approved administration workflow and keep the platform on a supported maintenance path.
Verify Services After Updating
- Confirm the intended Dgraph version is running on every updated server.
- Validate application connectivity, expected read and write behavior, scheduled jobs, monitoring, and the database workloads that depend on the platform.
- Review ordinary service and platform alerts for verified post-maintenance problems, then resolve them through the established support process.
- Confirm administrator access is limited to approved users and that any public exposure is intentional.
If You Cannot Update Immediately
Reduce unnecessary exposure of database administration services, restrict access to approved operators, and schedule the earliest practical supported maintenance window. Temporary restrictions can reduce risk, but they do not replace the corrected Dgraph release.
Related FixItPhill Guidance
Use the FixItPhill security library to track broader server maintenance priorities. Teams that also maintain customer websites can use the WordPress support hub for routine site maintenance and verification guidance.