How to Fix: ERR_OSSL_EVP_UNSUPPORTED (digital envelope routines)

Quick Fix

This is almost always a Node.js + Webpack build error, not an app crash. Try this first:

1. Set the legacy OpenSSL provider. In your terminal, run: export NODE_OPTIONS=--openssl-legacy-provider (macOS/Linux/Git Bash) or set NODE_OPTIONS=--openssl-legacy-provider (Windows CMD) or $env:NODE_OPTIONS='--openssl-legacy-provider' (PowerShell), then rerun your build/start command.
2. Re-run your command (e.g. npm run start, npm run build, ng serve, ionic serve). The error should disappear.

Step-by-Step Guide

What this error means

ERR_OSSL_EVP_UNSUPPORTED (shown alongside text like error:0308010C:digital envelope routines::unsupported) is a Node.js crypto error. It shows up when running commands like npm start, npm run build, ng serve, vue-cli-service serve, or ionic serve.

The error occurs because Node.js v17 and later use OpenSSL v3.0 which has had breaking changes. Specifically, the error originates from changes introduced in Node.js 17 and OpenSSL 3, affecting the initialization context of the md family, including md4. Older versions of Webpack use the MD4 hashing algorithm internally to generate build hashes, and OpenSSL 3 no longer allows MD4 by default for security reasons - so Node throws this error instead of completing the build.

This is a build-tool/environment issue, not something wrong with your account, your internet connection, or your hardware.

Fix 1: Enable the OpenSSL legacy provider (fastest, works immediately)

1. Set the environment variable before running your command. Open your terminal and run the version matching your shell:
   macOS/Linux/Git Bash: export NODE_OPTIONS=--openssl-legacy-provider
   Windows Command Prompt: set NODE_OPTIONS=--openssl-legacy-provider
   Windows PowerShell: $env:NODE_OPTIONS="--openssl-legacy-provider"
2. Rerun your build/serve command in the same terminal session.
3. If you get 'is not allowed in NODE_OPTIONS' error, unset the NODE_OPTIONS environment variable and rerun your script after deleting it. Then instead add the flag directly to the command, e.g. append --openssl-legacy-provider to the script in your package.json.
4. On Windows, if 'NODE_OPTIONS' is not recognized as a command, install the cross-env package (npm install cross-env --save-dev) and prefix your script, for example: cross-env NODE_OPTIONS=--openssl-legacy-provider ng serve.
5. For a permanent fix per project, edit the scripts section of package.json directly, e.g. for Next.js: 'dev': 'cross-env NODE_OPTIONS=--openssl-legacy-provider next dev'.

Fix 2: Upgrade the outdated build tool instead of patching OpenSSL

1. Upgrade Webpack. The fix for this error was released in Webpack 5.61.0, in which the maintainer sokra added an MD4 implementation using Web Assembly. Run npm install webpack@latest if your project uses Webpack directly.
2. Upgrade react-scripts (Create React App). If you use create-react-app, update your react-scripts version because the package introduced fixes to its Webpack config in version 5.0.0. The error also occurs if you have an outdated version of react-scripts. Run npm install react-scripts@latest (or yarn add react-scripts@latest).
3. Update other framework CLIs (Angular CLI, Vue CLI, Vuepress, etc.) to their latest major version, since newer releases generally bundle a Webpack version that no longer needs MD4.
4. Clean reinstall after upgrading. Delete your node_modules and package-lock.json (or yarn.lock), clean your npm cache with npm cache clean --force, then run npm install again.

Fix 3: Downgrade Node.js as a temporary workaround

1. Install an older Node.js LTS release (v16.x or earlier) using nvm (nvm install 16 && nvm use 16) since these ship with OpenSSL 1.1.1, which still supports MD4 by default.
2. Only use this as a stopgap. OpenSSL 1.1.1 is unsupported as of November 2023, and OpenSSL 3 being a major update means it is not completely backwards compatible, so plan to upgrade your build tooling instead of staying on an old Node version long-term.

Fix 4: Rule out other causes (native modules, custom crypto code)

1. Rebuild native modules. If your project depends on native Node addons, run npm rebuild after any Node.js version change, since modules compiled for one OpenSSL version can misbehave on another.
2. Check your own code for deprecated crypto calls. If you directly call crypto.createHash() with an unsupported algorithm like md4, switch to a modern one such as sha256.
3. If none of the above resolves it, the issue is likely coming from a third-party dependency deep in your project's build chain (a plugin or loader) rather than your own config — check that dependency's GitHub issues page for an updated version, or report it there, since this is a compatibility bug that maintainers usually need to patch.

Platform note: This error is not tied to Windows, macOS, or Linux specifically — it happens on any OS wherever Node.js 17+ and OpenSSL 3.0 are used. The exact commands to set environment variables differ by shell (bash/zsh vs Command Prompt vs PowerShell), as shown above.