How to fix Error: error:0308010C:digital envelope routines::unsupported in React

ReactBEGINNERHIGHUpdated Dec 9, 2025· 250 views

Create React App build scripts fail on Node.js 17+ due to OpenSSL 3.0 changes that deprecated certain cryptographic algorithms used by Webpack 4. The build works fine on Node 16 but crashes with ERR_OSSL_EVP_UNSUPPORTED on newer versions.

Quick fix

Fixes ERR_OSSL_EVP_UNSUPPORTED

node --version
  1. Verify your Node.js version
  2. Quick fix: Add legacy OpenSSL provider flag to package.json
  3. Recommended: Update react-scripts to version 5.0.0 or later
  4. Alternative: Downgrade to Node 16 LTS
react — error
node --version
Error: error:0308010C:digital envelope routines::unsupported

What this error means

This error occurs because Node.js 17 introduced OpenSSL 3.0, which removed support for legacy cryptographic algorithms including the MD4 hash algorithm. Create React App (CRA) projects that use older versions of react-scripts rely on Webpack 4, which uses these deprecated algorithms for certain operations like generating content hashes. When you run `npm run build` or `npm start` on Node 17 or later, Webpack attempts to use these unsupported algorithms and Node.js throws the ERR_OSSL_EVP_UNSUPPORTED error, causing the build to fail immediately. This is specifically a compatibility issue between older CRA tooling and modern Node.js versions. The same application builds successfully on Node 16 because that version still uses OpenSSL 1.1.1, which supports the legacy algorithms.

Typical symptoms

  • Build fails immediately with "error:0308010C:digital envelope routines::unsupported"
  • Error message includes "ERR_OSSL_EVP_UNSUPPORTED" in the stack trace
  • The same project builds successfully on Node 16 or earlier
  • Error occurs during webpack compilation phase
  • Both npm start and npm run build commands fail with the same error
  • CI/CD pipelines fail after upgrading Node.js to version 17 or 18

Common causes

  1. Using Node.js 17 or later with Create React App projects that have react-scripts version below 5.0.0
  2. Webpack 4 attempting to use MD4 hashing algorithm which is no longer supported in OpenSSL 3.0
  3. Node.js 17+ includes OpenSSL 3.0 by default, which removed legacy cryptographic algorithm support
  4. Project dependencies have not been updated to versions compatible with newer Node.js releases

How to fix "Error: error:0308010C:digital envelope routines::unsupported"

1Verify your Node.js version

First, confirm you're using Node 17 or later:

bash
node --version

If the version is 17.x or higher, this is likely the cause of the error.

2Quick fix: Add legacy OpenSSL provider flag to package.json

The fastest solution is to modify your package.json scripts to use the legacy OpenSSL provider:

json
{
  "scripts": {
    "start": "react-scripts --openssl-legacy-provider start",
    "build": "react-scripts --openssl-legacy-provider build"
  }
}

Then run your build again:

bash
npm run build

This tells Node.js to use the legacy cryptographic algorithms that Webpack 4 expects.

3Recommended: Update react-scripts to version 5.0.0 or later

For a long-term solution, upgrade react-scripts which includes Webpack 5 and is compatible with Node 17+:

bash
npm install react-scripts@latest

After upgrading, you can remove the --openssl-legacy-provider flag from your scripts. Note that upgrading react-scripts may require resolving breaking changes in your code.

4Alternative: Downgrade to Node 16 LTS

If you cannot update dependencies immediately, downgrade to Node 16:

Using nvm (recommended):

bash
nvm install 16
nvm use 16

Or download Node 16 LTS directly from the official Node.js website. This is a temporary workaround since Node 16 reached end-of-life in September 2023.

5For CI/CD: Set NODE_OPTIONS environment variable

If you need a quick fix for CI/CD pipelines without modifying package.json, set the NODE_OPTIONS environment variable:

Linux/macOS:

bash
export NODE_OPTIONS=--openssl-legacy-provider
npm run build

Windows Command Prompt:

bash
set NODE_OPTIONS=--openssl-legacy-provider && npm run build

Windows PowerShell:

bash
$env:NODE_OPTIONS="--openssl-legacy-provider"; npm run build

For GitHub Actions, add to your workflow file:

yaml
env:
  NODE_OPTIONS: --openssl-legacy-provider

Important: Do not set NODE_OPTIONS globally in your system environment variables, as this flag is not allowed in the NODE_OPTIONS environment variable in some contexts and may cause other issues.

Advanced notes

Why This Happens

Webpack 4 uses the MD4 hash algorithm for generating content hashes in various scenarios, particularly for module identifiers and chunk hashing. When Node.js 17 switched to OpenSSL 3.0, MD4 was removed from the default set of available algorithms due to security concerns (MD4 is considered cryptographically broken).

Security Considerations

Using --openssl-legacy-provider re-enables these legacy algorithms system-wide for your Node.js process. While this is safe for development builds (the hashes aren't used for security purposes), it's a workaround rather than a proper fix. The better approach is updating to react-scripts 5.0+ which uses Webpack 5 and modern hashing algorithms.

Webpack 5 Migration

React Scripts 5.0.0 upgraded to Webpack 5, which uses more modern hashing algorithms (SHA-256 by default) that are supported in OpenSSL 3.0. If you're maintaining an older CRA project, consider following the official migration guide or ejecting and manually upgrading Webpack.

Alternative Build Tools

If you're starting a new React project, consider using modern alternatives to Create React App that are actively maintained and compatible with the latest Node.js versions:
- Vite (recommended for new projects)
- Next.js (for full-stack React applications)
- Remix (for modern React framework)

These tools have better performance and are designed to work with current Node.js releases.

Frequently asked questions

What does "ERR_OSSL_EVP_UNSUPPORTED" mean?
0, which removed support for legacy cryptographic algorithms including the MD4 hash algorithm. Create React App (CRA) projects that use older versions of react-scripts rely on Webpack 4, which uses these deprecated algorithms for certain operations like generating content hashes. js throws the ERR_OSSL_EVP_UNSUPPORTED error, causing the build to fail immediately.
How do I fix "ERR_OSSL_EVP_UNSUPPORTED"?
Create React App build scripts fail on Node.js 17+ due to OpenSSL 3.0 changes that deprecated certain cryptographic algorithms used by Webpack 4. The build works fine on Node 16 but crashes with ERR_OSSL_EVP_UNSUPPORTED on newer versions.
What causes "ERR_OSSL_EVP_UNSUPPORTED"?
Using Node.js 17 or later with Create React App projects that have react-scripts version below 5.0.0 Webpack 4 attempting to use MD4 hashing algorithm which is no longer supported in OpenSSL 3.0 Node.js 17+ includes OpenSSL 3.0 by default, which removed legacy cryptographic algorithm support
Is the "ERR_OSSL_EVP_UNSUPPORTED" error serious?
Yes. This is a high-severity error that usually blocks work until it is fixed, but the steps above resolve it.

Official resources & further reading