error:0308010C:digital envelope routines::unsupported

Node.js 17+ (OpenSSL 3) — code ERR_OSSL_EVP_UNSUPPORTED

What it means

Some code asked OpenSSL 3 for an algorithm that its default provider no longer offers — most famously MD4, which old webpack versions use for build hashing. Node 17 switched to OpenSSL 3, and legacy digests/ciphers moved to a separate "legacy" provider that is off by default. The error names the mechanism (EVP, the digital envelope layer), not the culprit — and the same code appears anywhere OpenSSL 3 is asked for a retired algorithm, though the webpack-on-Node-17+ combination produces the overwhelming majority of hits.

Why it happens

• Old build tooling requesting MD4

  common

  webpack 4 (and react-scripts 4, vue-cli 4, older Angular) hash modules with MD4 by default. On Node ≥17 the first build step dies with this error. The stack trace usually shows createHash inside webpack.

• Application code using legacy primitives

  occasional

  Direct calls like createHash("md4"), createCipheriv with RC4/DES/Blowfish, or dependencies doing the same. These algorithms are cryptographically broken and were intentionally moved out of the default provider.

• Ancient PKCS#12/keystore files

  rare

  Old .p12/.pfx bundles encrypted with RC2/RC4-based schemes hit the same wall when loaded on OpenSSL 3 stacks.

How to fix it

1. 1.

   Upgrade the toolchain (the real fix)

   webpack ≥ 5.61 hashes with a WASM implementation and never asks OpenSSL for MD4; react-scripts 5 includes it. This removes the problem instead of masking it.

   npm install --save-dev webpack@latest
   # CRA projects:
   npm install --save-dev react-scripts@5

2. 2.

   Stopgap: enable the legacy provider

   Re-enables MD4 and friends process-wide. Acceptable to unblock a build today; do not make it permanent — it re-exposes broken algorithms to all code in the process.

   NODE_OPTIONS=--openssl-legacy-provider npm run build

3. 3.

   In your own code, replace the algorithm

   For non-cryptographic fingerprinting, any modern digest works; nothing that verifies signatures should be on MD4/MD5 in the first place.

   // before: createHash("md4")
   import { createHash } from "node:crypto";
   const digest = createHash("sha256").update(data).digest("hex");

← Browse the full signature error database