We update Node.js on servers and in Docker images, check where your app decodes Brotli, confirm what your platform really runs, and move apps off Node.js 18 and 20. Fixed prices, and a dated sign-off of what we did and how we checked it.
Start here
Vercel, Lambda, Heroku and the like. Some update Node.js themselves, some only on your next build. We confirm which you're on.
Platform confirmation, £195
A server, a VPS or Docker images your pipeline builds. Nobody else will update it. We do, and prove it.
Patch and verify, £450
End-of-life: no fix is coming. The answer is an upgrade to Node.js 24 or 26.
Upgrade, from £795
Fix it now
£195
2 working days
For apps on a platform: Vercel, AWS Lambda, Heroku, Render and the like. Some update Node.js themselves, some only when you rebuild. We confirm which Node.js actually runs your code.
£450per app or server
Done within 2 working days
For Node.js you run yourself: on a server, in Docker, or in images your CI builds. We update it, prove it, and check the Brotli exposure.
£750per app or server
Work starts within 4 working hours
The same job, started the same working day. We take up to two priority jobs a day across PHP and Node.js.
Get off old Node.js
£795
5 working days
One app on an end-of-life Node.js, moved to Node.js 24 or 26 long-term support.
£1,950
10 working days
Several services, a monorepo, native add-ons, or a framework move such as Express 4 to 5, up to about two days of work.
From £4,500
Scoped first
Node.js 16 or older, abandoned frameworks, or code nobody has touched in years. A paid scoping day (£900, credited against the work) comes first, then a fixed quote.
Keep it fixed
£99a month per site
Set up within 5 working days
For a site on managed hosting or a platform. We watch its PHP or Node.js, its platform and its end-of-life dates, and keep it current.
£249a month per server
Set up within 5 working days
For a server or container host you own. We keep its operating system, PHP or Node.js patched and prove it each month.
All prices are fixed, excluding VAT, and agreed in writing before any work starts.
Questions
For a server: a separate SSH account or key just for us. For containers and CI: access to the repository and the pipeline, or a pairing session with your developer. For a platform such as Vercel or Lambda: read access to the project. Never your own password, and you remove our access when the job is signed off.
Patch releases within a Node.js line rarely break apps, and we run your tests on the new version before anything goes live. Upgrades from Node.js 18 or 20 are rehearsed on a staging copy with a rollback plan. If something breaks, we roll back and fix it within the job's price.
We found no reports of exploitation as of 21 October. If your app decodes Brotli from outside and the logs or behaviour look wrong, we'll say so and quote a compromise check, the same £850 as for PHP servers. For a confirmed breach involving personal or payment data we'll refer you to an NCSC-assured incident response provider.
09:00 to 17:30 UK time, Monday to Friday. Turnaround times count working hours and days. We don't sell 24/7 cover we can't staff.
We work with businesses in the UK and Ireland, and take on work from elsewhere in Europe and North America on request. Prices are for business customers.
Send us the app and where it runs. We'll tell you which job you need, if any, and what it costs. Running PHP too? The PHP security service works the same way.