Webpack "error:0308010C:digital envelope routines::unsupported"

By Daniel Zoghalchali·Latchkey

Node 17+ ships OpenSSL 3, which removed the legacy MD4 hashing older Webpack 4 (and some loaders) use internally. The build crashes with an OpenSSL "unsupported" error that has nothing to do with your code.

What this error means

A build that passed on Node 16 fails after a Node upgrade with error:0308010C:digital envelope routines::unsupported. It appears immediately at hashing time, on every run, only on Node 17 and newer.

webpack output

Error: error:0308010C:digital envelope routines::unsupported
    at new Hash (node:internal/crypto/hash:69:19)
    at Object.createHash (node:crypto:133:10)
opensslErrorStack: [ 'error:03000086:digital envelope routines::initialization error' ],
library: 'digital envelope routines', reason: 'unsupported', code: 'ERR_OSSL_EVP_UNSUPPORTED'

Common causes

OpenSSL 3 on Node 17+ vs legacy hashing

Webpack 4 (and tools built on it, like older create-react-app and vue-cli) use MD4 for module hashing. OpenSSL 3 disables it by default, so the hash call throws ERR_OSSL_EVP_UNSUPPORTED.

Runner Node bumped without bumping the toolchain

CI moved to a newer Node image while the project still depends on Webpack 4-era tooling that has not been upgraded.

How to fix it

Enable the OpenSSL legacy provider (quick unblock)

Set NODE_OPTIONS so Node re-enables the legacy hashing the old toolchain needs.

Terminal

# in the build step
export NODE_OPTIONS=--openssl-legacy-provider
npm run build
# package.json (cross-env for portability)
# "build": "cross-env NODE_OPTIONS=--openssl-legacy-provider webpack"

Upgrade the toolchain (durable fix)

Upgrade to Webpack 5 (or a framework version built on it), which hashes with a supported algorithm.
Remove the --openssl-legacy-provider flag once the build no longer needs it.
Alternatively pin the runner to Node 16 only as a stopgap, not a long-term answer.

How to prevent it

Keep Webpack and framework tooling on versions compatible with current Node/OpenSSL.
Track Node major upgrades in CI and test the build before bumping the image.
Treat --openssl-legacy-provider as temporary and schedule the upgrade that removes it.

Frequently asked questions

What causes ""digital envelope routines""?

Webpack 4 (and tools built on it, like older create-react-app and vue-cli) use MD4 for module hashing. OpenSSL 3 disables it by default, so the hash call throws ERR_OSSL_EVP_UNSUPPORTED.

How do I fix "digital envelope routines"?

Set NODE_OPTIONS so Node re-enables the legacy hashing the old toolchain needs.