Error: error:0308010C:digital envelope routines::unsupported

What is ERR_OSSL_EVP_UNSUPPORTED?

ERR_OSSL_EVP_UNSUPPORTED is a Node.js error code that wraps an OpenSSL error. The full string users see is:

Error: error:0308010C:digital envelope routines::unsupported

The hex code 0308010C is an OpenSSL error identifier: library 3 (EVP — envelope encryption), reason 0x10C (algorithm not supported). OpenSSL 3.0 introduced a new provider architecture that disabled several legacy algorithms — including MD4 — by default. Webpack 4's default hash function for module IDs and chunk names is MD4. When Webpack 4 calls Node.js's crypto.createHash('md4'), OpenSSL 3.0 refuses and throws ERR_OSSL_EVP_UNSUPPORTED.

The error is documented in the Node.js API errors reference.

Full Error Example

$ npm start

> my-react-app@0.1.0 start
> react-scripts start

node:internal/crypto/hash:71
  this[kHandle] = new Hash(algorithm, xofLen);
                  ^

Error: error:0308010C:digital envelope routines::unsupported
    at new Hash (node:internal/crypto/hash:71:19)
    at Object.createHash (node:crypto:130:10)
    at module.exports (/project/node_modules/webpack/lib/util/createHash.js:135:53)
    at NormalModule._initBuildHash (/project/node_modules/webpack/lib/NormalModule.js:417:16)
    at handleParseError (/project/node_modules/webpack/lib/NormalModule.js:471:10)
    at /project/node_modules/webpack/lib/NormalModule.js:503:5
    at /project/node_modules/webpack/lib/NormalModule.js:358:12
    at /project/node_modules/loader-runner/lib/LoaderRunner.js:373:3 {
  opensslErrorStack: [ 'error:03000086:digital envelope routines::initialization error' ],
  library: 'digital envelope routines',
  reason: 'unsupported',
  code: 'ERR_OSSL_EVP_UNSUPPORTED'
}

The error object includes these diagnostic fields:

Node.js Version Matrix

All Causes at a Glance

Cause 1 – Webpack 4 Default MD4 Hash

Webpack 4 uses MD4 as its default hash algorithm for generating module IDs, chunk names, and content hashes. The call originates deep inside Webpack's createHash.js utility, which delegates to Node.js's built-in crypto.createHash('md4'). On Node.js 17+ with OpenSSL 3.0, this call fails immediately.

Webpack 5 (released October 2020) replaced this by shipping its own MD4 implementation in pure JavaScript (webpack/lib/util/Hash.js). It never calls crypto.createHash('md4'), so OpenSSL 3.0 is never involved.

# The call chain that throws:
# webpack/lib/util/createHash.js  →  crypto.createHash('md4')  →  OpenSSL 3.0 rejects it

# Verify which webpack version you have:
npx webpack --version
# or
cat node_modules/webpack/package.json | grep '"version"'

Cause 2 – Create React App with react-scripts < 5

Create React App pins its internal Webpack version. react-scripts versions 1–4 all use Webpack 4, so any CRA project not yet upgraded to react-scripts@5 will throw ERR_OSSL_EVP_UNSUPPORTED on Node.js 17+.

# Check your current react-scripts version:
cat node_modules/react-scripts/package.json | grep '"version"'

# Affected: react-scripts 1.x, 2.x, 3.x, 4.x (all use Webpack 4)
# Safe: react-scripts 5.0.0+ (uses Webpack 5)

Cause 3 – Angular CLI 11 or 12

Angular CLI switched from Webpack 4 to Webpack 5 in Angular 13 (November 2021). Projects on Angular 11 or 12 use Webpack 4 internally and hit this error on Node.js 17+. Angular 13+ is fully unaffected.

# Check Angular CLI version:
ng version

# Affected: @angular/cli 11.x, 12.x (Webpack 4)
# Safe: @angular/cli 13.x and above (Webpack 5)

Cause 4 – Vue CLI with Webpack 4 (vue-cli-service)

Vue CLI projects created with @vue/cli before the Vue 3 / Vite era use Webpack 4 via vue-cli-service. Running npm run serve or npm run build on Node.js 17+ throws ERR_OSSL_EVP_UNSUPPORTED.

# Check vue-cli-service webpack version:
cat node_modules/@vue/cli-service/package.json | grep '"webpack"'

# If webpack: "^4.x.x" — you are affected. Apply the workaround or migrate to Vite.

Cause 5 – Storybook < 7 / Other Webpack 4 Tools

Any tool that vendor-bundles Webpack 4 is affected: Storybook 5–6, Gatsby v3 and earlier, Next.js v10 and earlier, and custom Webpack 4 configs. Storybook v7+ and Gatsby v4+ all moved to Webpack 5.

# Storybook version check:
cat node_modules/@storybook/core/package.json | grep '"version"'

# Gatsby version check:
cat node_modules/gatsby/package.json | grep '"version"'

Fix 1 – Quick Workaround: NODE_OPTIONS=--openssl-legacy-provider

The --openssl-legacy-provider flag tells OpenSSL 3.0 to load its legacy provider, which re-enables MD4 and other deprecated algorithms. This unblocks Webpack 4 immediately without any code changes.

macOS / Linux (bash/zsh — single session)

export NODE_OPTIONS=--openssl-legacy-provider
npm start
# or in one line:
NODE_OPTIONS=--openssl-legacy-provider npm start

Windows Command Prompt (CMD)

set NODE_OPTIONS=--openssl-legacy-provider
npm start

Windows PowerShell

$env:NODE_OPTIONS="--openssl-legacy-provider"
npm start

Cross-platform: add to package.json scripts with cross-env (recommended)

# Install cross-env once:
npm install --save-dev cross-env

# Then update package.json scripts:
{
  "scripts": {
    "start":       "cross-env NODE_OPTIONS=--openssl-legacy-provider react-scripts start",
    "build":       "cross-env NODE_OPTIONS=--openssl-legacy-provider react-scripts build",
    "test":        "cross-env NODE_OPTIONS=--openssl-legacy-provider react-scripts test",
    "storybook":   "cross-env NODE_OPTIONS=--openssl-legacy-provider start-storybook -p 6006",
    "ng":          "cross-env NODE_OPTIONS=--openssl-legacy-provider ng"
  }
}

Persist via .npmrc (applies to all npm commands in the project)

# Create or edit .npmrc in the project root:
node-options=--openssl-legacy-provider

# This is equivalent to setting NODE_OPTIONS for every npm run command.
# Commit this file to source control so all contributors get the same behavior.

Fix 2 – Proper Fix for Create React App: Upgrade react-scripts to v5

react-scripts@5.0.0 (January 2022) upgraded CRA's internal Webpack from 4 to 5. This is the recommended permanent fix for all CRA projects.

# Step 1: update react-scripts
npm install --save-exact react-scripts@5.0.1

# Step 2: clean install to avoid stale Webpack 4 packages in node_modules
rm -rf node_modules package-lock.json
npm install

# Step 3: verify — npm start should now work on Node.js 18/20/22 without NODE_OPTIONS
npm start

Fix 3 – Proper Fix for Angular: Upgrade to Angular 13+

Angular CLI 13 (November 2021) migrated to Webpack 5. The Angular team provides ng update to automate the migration across major versions.

# From Angular 12 to 13 (do one major version at a time):
ng update @angular/cli@13 @angular/core@13

# Verify the migration succeeded — ng serve should work without NODE_OPTIONS:
ng serve

# If you are on Angular 11, first update to 12, then to 13:
ng update @angular/cli@12 @angular/core@12
ng update @angular/cli@13 @angular/core@13

Consult the official Angular update guide at update.angular.io for a step-by-step checklist tailored to your specific version jump.

Fix 4 – Proper Fix for Plain Webpack Projects: Upgrade to Webpack 5

If your project uses Webpack directly (not via CRA or Angular CLI), upgrade webpack and webpack-cli to v5. Webpack 5 made many breaking changes — review the official Webpack 5 migration guide.

# Install Webpack 5:
npm install --save-dev webpack@5 webpack-cli@5

# Key Webpack 5 breaking changes to check:
# 1. Node.js core module polyfills removed — add them explicitly if needed
# 2. Module Federation is now built in
# 3. Output.hashFunction defaults to 'xxhash64' (not md4) on Node.js 17+
# 4. Asset modules replace file-loader, url-loader, raw-loader

# If you need to keep md4 compatible hashes (e.g. deterministic chunk names):
# webpack.config.js
module.exports = {
  output: {
    hashFunction: 'sha256',  // or 'xxhash64' for speed
  },
};

# Verify:
npx webpack --version
# Expected: webpack 5.x.x

Fix 5 – Vue CLI Projects: Use --openssl-legacy-provider or Migrate to Vite

Vue CLI does not have a built-in path to Webpack 5 as clean as CRA or Angular CLI. The recommended modern approach for new Vue 3 projects is Vite. For existing Vue CLI projects, use the cross-env workaround until a Vite migration is feasible.

# Short-term: add cross-env to vue-cli scripts
# package.json
{
  "scripts": {
    "serve": "cross-env NODE_OPTIONS=--openssl-legacy-provider vue-cli-service serve",
    "build": "cross-env NODE_OPTIONS=--openssl-legacy-provider vue-cli-service build"
  }
}

# Long-term: migrate to Vite
# https://vitejs.dev/guide/migration-from-v2.html

Fix 6 – Replace node-sass with sass (Dart Sass)

node-sass (libsass bindings) is deprecated and also triggers ERR_OSSL_EVP_UNSUPPORTED via its native gyp build pipeline on newer Node.js. Replace it with sass (Dart Sass), which is the actively maintained successor.

# Remove node-sass:
npm uninstall node-sass

# Install sass (Dart Sass — pure JS, no native bindings):
npm install --save-dev sass

# In CRA: sass is all you need; react-scripts automatically picks it up.
# In Webpack: update sass-loader to use 'sass' instead of 'node-sass':
# webpack.config.js
{
  loader: 'sass-loader',
  options: {
    implementation: require('sass'),  // or omit — sass-loader auto-detects
  }
}

Fix 7 – App Code Using crypto.createHash('md4') Directly

If the stack trace points to your own application code (not Webpack internals), you have a direct call to crypto.createHash('md4'). Replace it with a supported algorithm.

// Wrong — MD4 is not available in OpenSSL 3.0 without the legacy provider
const crypto = require('crypto');
const hash = crypto.createHash('md4').update(data).digest('hex');

// Fix — use SHA-256 (strongly recommended for security) or SHA-1 (if you need short hashes)
const hash256 = crypto.createHash('sha256').update(data).digest('hex');
const hash1   = crypto.createHash('sha1').update(data).digest('hex');

// If you must maintain MD4 output for legacy compatibility, use a pure-JS implementation:
// npm install md4  (or  npm install spark-md5)
const SparkMD4 = require('spark-md5');
const md4hash = SparkMD4.hash(data);

Fix 8 – Docker and CI Environments

CI/CD pipelines and Docker images frequently use the latest Node.js LTS base image, which ships with OpenSSL 3.0. This is why the error appears in CI but not on a developer's machine running Node.js 16.

Dockerfile — short-term workaround

FROM node:20-alpine
WORKDIR /app

# Set legacy provider for the build step only
ENV NODE_OPTIONS=--openssl-legacy-provider

COPY package*.json ./
RUN npm ci
COPY . .
RUN npm run build

# For the runtime stage, do NOT carry NODE_OPTIONS into production
FROM node:20-alpine
WORKDIR /app
COPY --from=0 /app/build ./build
COPY --from=0 /app/node_modules ./node_modules
# NODE_OPTIONS is not set here — good
CMD ["node", "server.js"]

GitHub Actions

# .github/workflows/build.yml
jobs:
  build:
    runs-on: ubuntu-latest
    env:
      NODE_OPTIONS: --openssl-legacy-provider   # workaround for Webpack 4
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '20'
      - run: npm ci
      - run: npm run build

GitLab CI

# .gitlab-ci.yml
build:
  image: node:20-alpine
  variables:
    NODE_OPTIONS: "--openssl-legacy-provider"
  script:
    - npm ci
    - npm run build

Decision Tree: Quick Fix vs. Upgrade

Safe Patterns After Upgrading to Webpack 5

Verify Webpack 5 hash algorithm (webpack.config.js)

// webpack.config.js — Webpack 5 default is 'xxhash64' on Node 17+
// Both are fully supported without --openssl-legacy-provider
module.exports = {
  output: {
    // 'xxhash64' is the default and fastest option in Webpack 5
    // 'sha256' if you want a well-known cryptographic hash
    hashFunction: 'xxhash64',
  },
  // No special OpenSSL flags needed
};

Using Node.js crypto with supported algorithms (Node.js 17+)

const crypto = require('crypto');

// These algorithms are all supported in OpenSSL 3.0 without the legacy provider:
const sha256 = crypto.createHash('sha256').update('hello').digest('hex');
const sha512 = crypto.createHash('sha512').update('hello').digest('hex');
const sha1   = crypto.createHash('sha1').update('hello').digest('hex');

// List all available algorithms on your Node.js version:
console.log(crypto.getHashes());
// Note: 'md4' will NOT appear in the list on Node.js 17+ without --openssl-legacy-provider

Verify the fix worked — check crypto.getHashes()

// Run this snippet to check if MD4 is available in your environment:
const crypto = require('crypto');
const hashes = crypto.getHashes();

if (hashes.includes('md4')) {
  console.log('MD4 is available (Node.js 16 or --openssl-legacy-provider is active)');
} else {
  console.log('MD4 is NOT available — Webpack 4 will fail on this Node.js version');
  console.log('Use Webpack 5 or set NODE_OPTIONS=--openssl-legacy-provider');
}

Debugging Checklist

1. Run node --version. If it is v17 or higher, OpenSSL 3.0 is the cause.
2. Check the stack trace for webpack/lib/util/createHash.js — this confirms Webpack 4 is the caller.
3. Run npx webpack --version or check node_modules/webpack/package.json for the version.
4. For CRA, check node_modules/react-scripts/package.json version — if it is < 5.0.0, upgrade it.
5. For Angular, run ng version — if @angular/cli is 11 or 12, upgrade to 13.
6. Apply the quick fix (NODE_OPTIONS=--openssl-legacy-provider) to unblock yourself while you plan the proper upgrade.
7. After upgrading to Webpack 5, run node -e "require('crypto').createHash('sha256')" to confirm crypto works.
8. In CI, verify the node-version input in your workflow file matches your local Node.js version, or add NODE_OPTIONS to the CI environment.
9. Remove all NODE_OPTIONS=--openssl-legacy-provider references from scripts after completing the Webpack 5 upgrade.
10. If using node-sass, replace it with sass (Dart Sass) as a separate fix.

Frequently Asked Questions

npm install --save-exact react-scripts@5.0.1
rm -rf node_modules package-lock.json
npm install

ng update @angular/cli@13 @angular/core@13

"start": "cross-env NODE_OPTIONS=--openssl-legacy-provider ng serve",
"build": "cross-env NODE_OPTIONS=--openssl-legacy-provider ng build"

ENV NODE_OPTIONS=--openssl-legacy-provider

env:
  NODE_OPTIONS: --openssl-legacy-provider

nvm install 16
nvm use 16
node --version  # v16.x.x

Related Errors

• FATAL ERROR: JavaScript heap out of memory — another build-time fatal error, often from Webpack on large codebases; fix with --max-old-space-size
• ERR_DLOPEN_FAILED — native addon ABI mismatch after a Node.js upgrade; similar "upgrade broke my build" pattern
• Error: Cannot find module — another common build-time error; missing npm install or broken node_modules
• ENOSPC: System limit for number of file watchers reached — another Webpack dev server failure, caused by inotify limits on Linux
• ERR_REQUIRE_ESM — a different Node.js compatibility break triggered by upgrading packages that dropped CommonJS