# Node.js, Next.js, and React code audit > A fixed-fee code audit and security audit for Node.js, Next.js, React, and TypeScript apps, with a plain-English plan for what to fix first. - URL: https://velocitylabs.io/code-audit/nodejs/ Node.js code audit # A code audit for Node.js, Next.js, and React apps. JavaScript apps grow fast, often inherited, rushed to launch, or partly written by AI. We review your Node.js back end, Next.js or React front end, and TypeScript against the problems these apps actually have, and tell you in plain English which ones matter and what to fix first. ## What a Node.js code audit checks Every Node.js audit covers the eight areas in every code audit, plus checks written for Node.js, Next.js, React, and TypeScript. - ### Who can see whose data API routes, server actions, and route handlers that skip authorization, lookups that aren’t scoped to the signed-in user, sign-in checked only in middleware, and permissions enforced only in the UI. - ### Sign-in, sessions, and secrets JWT verification, cookie and CORS settings, password hashing, rate limits on sign-in, and API keys shipped to the browser in the client bundle or a `NEXT_PUBLIC_` variable. - ### Injection and unsafe input Request bodies used without validation, SQL and NoSQL injection through raw queries, unsafe file paths and uploads, server-side request forgery, prototype pollution, and `dangerouslySetInnerHTML`. - ### Data that holds up Multi-step writes without transactions, schema sync instead of migrations in production, money stored as floating point, webhooks that skip signature checks, and types that don’t match what’s really in the data. - ### Speed under real traffic Work that blocks the event loop, N+1 queries, connection pooling, outbound calls without timeouts, accidental dynamic rendering and caching surprises in Next.js, and oversized React bundles. - ### Version and upgrade path Whether your Node.js and Next.js versions still get security fixes, React and TypeScript versions that drift apart, abandoned packages, and how strict your TypeScript really is. ## More than an npm audit report Every audit runs npm audit, OSV-Scanner, Semgrep, ESLint, and the TypeScript compiler against your code, but scanners only find the patterns they know. The findings that hurt most in JavaScript apps are usually ones a scanner can’t see: - A server action that updates any record whose ID it’s given - Sign-in checked in middleware, but not where the data is read - A page cached with one user’s data and served to the next - A promise fired and forgotten, so failed emails vanish without a trace Those come from reading the code, not from a scan. ## Node.js code audit pricing Three levels, each a fixed fee. Essentials covers the most important Node.js and Next.js checks; Standard and Comprehensive cover all of them. [See everything every audit includes](https://velocitylabs.io/code-audit/). ### Essentials A fast health check **$1,000** fixed fee **Best for:** Answering "is this codebase OK?" before you buy, hire, or launch. - Review of your code, configuration, CI, and database schema - Automated scans for security issues, vulnerable and outdated dependencies, leaked secrets, and code quality - The essential checks for each technology in your stack - Critical and high findings written up in full ### Standard A thorough review **$1,500** fixed fee **Best for:** An inherited codebase, a pre-launch review, or before hiring a team. Everything in Essentials, plus: - Every check for each technology, not just the essentials - Your app and tests running in our isolated environment - How your team ships, when the code comes with its git history - Every finding written up in full ### Comprehensive Due diligence depth **$2,500** fixed fee **Best for:** Acquisitions and technical due diligence, compliance preparation, or after an incident. Everything in Standard, plus: - Line-by-line review of sign-in, payments, and data access - Steps to reproduce every finding - Your public website: accessibility, search visibility, and security headers - Domain and email setup: DNS, SPF, DKIM, and DMARC ## Is your Node.js version still supported? Node.js supports each even-numbered LTS line for about two and a half years, and Next.js supports each major for about two years, so many apps are running versions that no longer get security fixes. Every Node.js audit checks your Node.js and Next.js versions against the official schedules, and that the same Node.js version is pinned everywhere it runs. If you’re behind, the report lays out the upgrade step by step, along with the React, TypeScript, and package changes that come with it. When you’re ready, we can do the [upgrade](https://velocitylabs.io/maintenance/) too. _Node.js support today Latest: 26.13.1 LTS_ - Node.js 26 LTSSupported Active supportUntil Oct 20, 2027 Security fixesUntil Apr 30, 2029 - Node.js 24 LTSSecurity only Active supportEnded Oct 20, 2026 Security fixesUntil Apr 30, 2028 - Node.js 22 LTSSecurity only Active supportEnded Oct 21, 2025 Security fixesUntil Apr 30, 2027 - Node.js 20 and olderUnsupported Active supportEnded by Oct 22, 2024 Security fixesEnded by Apr 30, 2026 Checked November 13, 2026 against the [Node.js release schedule](https://nodejs.org/en/about/previous-releases). ## Node.js and Next.js apps we've built ![The Grant Lookout website:](https://velocitylabs.io/images/work/grant-lookout.webp) ### Grant Lookout Follows federal and state grant opportunities and tells you on your phone about new matches, moved deadlines and amended notices, with AI summaries of long notices. Android and iOS apps, with a web admin area. - [React Native](https://velocitylabs.io/portfolio/?tech=react-native) - [TypeScript](https://velocitylabs.io/portfolio/?tech=typescript) - [Next.js](https://velocitylabs.io/portfolio/?tech=next-js) - [Supabase](https://velocitylabs.io/portfolio/?tech=supabase) - [PostgreSQL](https://velocitylabs.io/portfolio/?tech=postgresql) - [AI Integration](https://velocitylabs.io/portfolio/?tech=ai-integration) - [API Integration](https://velocitylabs.io/portfolio/?tech=api-integration) ![paycheck results for software developers in Phoenix: a median of $131,750 a year, with a pay of $118,000 marked at about the 38th percentile](https://velocitylabs.io/images/work/paycheck.webp) ### paycheck Pick a job and a place to see what it pays, from the Bureau of Labor Statistics' wage data, where your own pay falls, and which local jobs pay the wage you want. - [Node.js](https://velocitylabs.io/portfolio/?tech=node-js) - [TypeScript](https://velocitylabs.io/portfolio/?tech=typescript) - [API Integration](https://velocitylabs.io/portfolio/?tech=api-integration) - [Docker](https://velocitylabs.io/portfolio/?tech=docker) [See more of our work](https://velocitylabs.io/portfolio/) ## Questions about Node.js code audits #How much does a Node.js code audit cost? The same fixed fees as every audit: $1,000 for Essentials, $1,500 for Standard, and $2,500 for Comprehensive. [Compare the levels](https://velocitylabs.io/code-audit/nodejs/#pricing). Hire us for hourly development within 30 days of your report and up to $1,000 of the fee comes off your first invoice. #Is a security audit included? Yes. Every Node.js code audit includes a security audit: data access, sign-in, sessions, secrets, injection, file uploads, and webhooks, plus npm audit, OSV-Scanner, and Semgrep scans of your code and packages. #Do you audit Next.js apps on the App Router and server actions? Yes. Next.js apps get their own checks: authorization in every server action and route handler, data that leaks from server to client components, cached pages served to the wrong user, and the caching rules for your version. Apps on the Pages Router, or halfway between, get the same review. #Can you audit a React front end with a different back end? Yes. A React app gets its own checks whatever it talks to: secrets in the bundle, where tokens are stored, permissions enforced only in the UI, and performance. If the back end is Rails, Laravel, or Python, it can be part of the audit too. #Do you need to run our app? Essentials reviews the code without running it. Standard and Comprehensive boot your app and run your tests in an isolated, disposable environment. Either way, we never connect to your production servers, databases, or accounts. #Can you fix what the audit finds? Yes. We can work alongside your team or take it on ourselves, and the audit credit applies.