Applies to: BioStar 2 v2.9.12 TA, BioStar X v1.0.3 TA
Last updated: 2026-10-29


We would like to confirm that the TA modules of BioStar 2 and BioStar X are not affected by the four recently disclosed Node.js vulnerabilities.


Summary

The Suprema products below use Node.js. However, they are NOT affected by the four Node.js security vulnerabilities disclosed on October 21, 2026. No patch is required.

  • BioStar 2 v2.9.12 TA
  • BioStar X v1.0.3 TA


Details

Vulnerabilities

  • CVE-2026-105482
  • CVE-2026-105483
  • CVE-2026-106069
  • CVE-2026-111497


Frequently Asked Questions

Q1. Do these products use Node.js?
Yes. The TA modules of both products use Node.js.

Q2. Are these products at risk from these vulnerabilities?
No. For some of these vulnerabilities, the TA’s Node.js version is in the affected range. However, the TA does not meet the conditions required for an attack.

Q3. Do I need to apply a security patch?
No. These products are not affected, so no patch is required.

Q4. When will the fix be completed?
Not applicable.

Q5. Do I need to update Node.exe in the biostar-migration folder?
No. This folder is not affected by these vulnerabilities. It is used only when upgrading from BioStar 1 to BioStar 2, so you can delete it if needed. However, the folder will be created again when you upgrade BioStar 2 to a newer version.

Q6. What can I do if I do not use the TA?
In Windows Services, stop the “BioStar 2 TA Web Server” service and set its Startup type to “Disabled”. Do not delete the TA folder.


Notes

  • This article applies only to the two products listed above.
  • This review does not cover third-party systems or integrated servers that you operate with these products. Contact the vendor of each system to check its Node.js usage.
  • We will update this article if new information becomes available.