ErrorVaultHQ

Solved Error

How to Fix: ERR_OSSL_EVP_UNSUPPORTED (digital envelope routines)

Quick Fix

This is almost always a Node.js + Webpack build error, not an app crash. Try this first: 1. Set the legacy OpenSSL provider. In your terminal, run: export NODE_OPTIONS=--openssl-legacy-provider (macOS/Linux/Git Bash) or set NODE_OPTIONS=--openssl-legacy-provider (Windows CMD) or $env:NODE_OPTIONS='--openssl-legacy-provider' (PowerShell), then rerun your build/start command. 2. Re-run your command (e.g. npm run start, npm run build, ng serve, ionic serve). The error should disappear.

What this error means

ERR_OSSL_EVP_UNSUPPORTED (shown alongside text like error:0308010C:digital envelope routines::unsupported) is a Node.js crypto error. It shows up when running commands like npm start, npm run build, ng serve, vue-cli-service serve, or ionic serve. The error occurs because Node.js v17 and later use OpenSSL v3.0 which has had breaking changes. Specifically, the error originates from changes introduced in Node.js 17 and OpenSSL 3, affecting the initialization context of the md family, including md4. Older versions of Webpack use the MD4 hashing algorithm internally to generate build hashes, and OpenSSL 3 no longer allows MD4 by default for security reasons - so Node throws this error instead of completing the build. This is a build-tool/environment issue, not something wrong with your account, your internet connection, or your hardware.

Step-by-Step Guide

Fix 1: Enable the OpenSSL legacy provider (fastest, works immediately)

  1. 1Set the environment variable before running your command. Open your terminal and run the version matching your shell: macOS/Linux/Git Bash: export NODE_OPTIONS=--openssl-legacy-provider Windows Command Prompt: set NODE_OPTIONS=--openssl-legacy-provider Windows PowerShell: $env:NODE_OPTIONS="--openssl-legacy-provider"
  2. 2Rerun your build or serve command. Rerun your build/serve command in the same terminal session.
  3. 3Clear NODE_OPTIONS and add flag to package.json. If you get 'is not allowed in NODE_OPTIONS' error, unset the NODE_OPTIONS environment variable and rerun your script after deleting it. Then instead add the flag directly to the command, e.g. append --openssl-legacy-provider to the script in your package.json.
  4. 4Install cross-env and use it on Windows. On Windows, if NODE_OPTIONS is not recognized as a command, install the cross-env package (npm install cross-env --save-dev) and prefix your script, for example: cross-env NODE_OPTIONS=--openssl-legacy-provider ng serve.
  5. 5Edit package.json scripts for permanent fix. For a permanent fix per project, edit the scripts section of package.json directly, e.g. for Next.js: 'dev': 'cross-env NODE_OPTIONS=--openssl-legacy-provider next dev'.

Fix 2: Upgrade the outdated build tool instead of patching OpenSSL

  1. 1Upgrade Webpack. The fix for this error was released in Webpack 5.61.0, in which the maintainer sokra added an MD4 implementation using Web Assembly. Run npm install webpack@latest if your project uses Webpack directly.
  2. 2Upgrade react-scripts (Create React App). If you use create-react-app, update your react-scripts version because the package introduced fixes to its Webpack config in version 5.0.0. The error also occurs if you have an outdated version of react-scripts. Run npm install react-scripts@latest (or yarn add react-scripts@latest).
  3. 3Update framework CLIs to latest major version. Update other framework CLIs (Angular CLI, Vue CLI, Vuepress, etc.) to their latest major version, since newer releases generally bundle a Webpack version that no longer needs MD4.
  4. 4Clean reinstall after upgrading. Delete your node_modules and package-lock.json (or yarn.lock), clean your npm cache with npm cache clean --force, then run npm install again.

Fix 3: Downgrade Node.js as a temporary workaround

  1. 1Downgrade Node.js to v16 or earlier. Install an older Node.js LTS release (v16.x or earlier) using nvm (nvm install 16 && nvm use 16) since these ship with OpenSSL 1.1.1, which still supports MD4 by default.
  2. 2Only use this as a stopgap. OpenSSL 1.1.1 is unsupported as of November 2023, and OpenSSL 3 being a major update means it is not completely backwards compatible, so plan to upgrade your build tooling instead of staying on an old Node version long-term.

Fix 4: Rule out other causes (native modules, custom crypto code)

  1. 1Rebuild native modules. If your project depends on native Node addons, run npm rebuild after any Node.js version change, since modules compiled for one OpenSSL version can misbehave on another.
  2. 2Check your own code for deprecated crypto calls. If you directly call crypto.createHash() with an unsupported algorithm like md4, switch to a modern one such as sha256.
  3. 3Check third-party dependencies for compatibility bugs. If none of the above resolves it, the issue is likely coming from a third-party dependency deep in your project's build chain (a plugin or loader) rather than your own config — check that dependency's GitHub issues page for an updated version, or report it there, since this is a compatibility bug that maintainers usually need to patch. Platform note: This error is not tied to Windows, macOS, or Linux specifically — it happens on any OS wherever Node.js 17+ and OpenSSL 3.0 are used. The exact commands to set environment variables differ by shell (bash/zsh vs Command Prompt vs PowerShell), as shown above.

Sources:

Heads up: this guide was drafted with AI assistance from the real sources listed below, and structured by our team for clarity. It may not cover every possible cause — if it doesn't fix your issue, let us know and we'll take a closer look. See how we create our fixes.

Was this fix helpful?

Related Error Fixes