How to fix Error: error:0308010C:digital envelope routines::unsupported in React

ReactBEGINNERHIGHUpdated Dec 22, 2025· 272 views

This error occurs when running Create React App projects with Node.js 17 or later due to breaking changes in OpenSSL 3.0. Webpack 4 (used by react-scripts 4.x) relies on the MD4 hashing algorithm, which is no longer supported by default in modern Node.js versions.

Quick fix

Fixes 0308010C

npm install react-scripts@latest
  1. Upgrade react-scripts to version 5 or later (recommended)
  2. Use the --openssl-legacy-provider flag in package.json
  3. Set NODE_OPTIONS environment variable
  4. Downgrade to Node.js 16 LTS
react — error
npm install react-scripts@latest
Error: error:0308010C:digital envelope routines::unsupported
shell
npm install react-scripts@latest

What this error means

This error indicates an incompatibility between Node.js 17+ (which uses OpenSSL 3.0) and older versions of Webpack (particularly Webpack 4). OpenSSL 3.0 deprecated and disabled several cryptographic algorithms by default, including the MD4 hash algorithm that Webpack 4 used in its build process for module hashing. When you try to start or build a Create React App project using react-scripts version 4.x or lower with Node.js 17+, the build process fails because Webpack attempts to use MD4 for content hashing, but Node.js refuses to perform this operation due to the security changes in OpenSSL 3.0. This is a compatibility issue between your Node.js version and your project's build tooling, not a problem with your application code itself.

Typical symptoms

  • npm start or npm run build fails immediately with "digital envelope routines::unsupported"
  • Error occurs right at the beginning of the Webpack compilation process
  • The error code 0308010C appears in the stack trace
  • Issue only started after upgrading to Node.js 17 or later
  • Same project works fine on machines with Node.js 16 or earlier
  • Error mentions ERR_OSSL_EVP_UNSUPPORTED in some Node versions

Common causes

  1. Using Node.js 17 or later with react-scripts version 4.x or lower
  2. Webpack 4 attempting to use MD4 hashing algorithm that is no longer supported in OpenSSL 3.0
  3. OpenSSL 3.0 deprecated legacy cryptographic algorithms for security reasons
  4. Project dependencies have not been updated to support newer Node.js versions
  5. Using older build tools that rely on deprecated OpenSSL features

How to fix "Error: error:0308010C:digital envelope routines::unsupported"

1Upgrade react-scripts to version 5 or later (recommended)

The best long-term solution is to upgrade react-scripts, which includes Webpack 5 and doesn't rely on MD4:

bash
npm install react-scripts@latest

Or if using Yarn:

bash
yarn add react-scripts@latest

After upgrading, test your application:

bash
npm start

This solution fixes the root cause by using a build tool compatible with modern Node.js versions.

2Use the --openssl-legacy-provider flag in package.json

If you cannot upgrade react-scripts immediately, enable OpenSSL's legacy provider mode. Update your package.json scripts:

json
{
  "scripts": {
    "start": "react-scripts --openssl-legacy-provider start",
    "build": "react-scripts --openssl-legacy-provider build"
  }
}

Then run your scripts normally:

bash
npm start

Important: The flag must come before the command (e.g., --openssl-legacy-provider start, not start --openssl-legacy-provider).

3Set NODE_OPTIONS environment variable

Alternatively, set the NODE_OPTIONS environment variable before running commands.

On Linux/macOS:

bash
export NODE_OPTIONS=--openssl-legacy-provider
npm start

On Windows (Command Prompt):

cmd
set NODE_OPTIONS=--openssl-legacy-provider
npm start

On Windows (PowerShell):

powershell
$env:NODE_OPTIONS="--openssl-legacy-provider"
npm start

You can also add this to your .env file in Create React App:

bash
NODE_OPTIONS=--openssl-legacy-provider

Note that some environments may not allow this flag in NODE_OPTIONS for security reasons.

4Downgrade to Node.js 16 LTS

If other solutions are not viable for your project, downgrade to Node.js 16 (the last LTS version before the OpenSSL 3.0 change).

Using nvm (Node Version Manager):

bash
nvm install 16
nvm use 16

Then verify the version:

bash
node --version
# Should show v16.x.x

This is a temporary workaround, as Node.js 16 will eventually reach end-of-life. Plan to upgrade your build tools for long-term support.

Advanced notes

Why MD4 was removed: OpenSSL 3.0 deprecated MD4 and other legacy algorithms because they are cryptographically weak and vulnerable to collision attacks. While Webpack's use of MD4 for content hashing is not a security risk (it's not being used for cryptographic security), the OpenSSL maintainers removed it from the default providers to encourage migration to modern algorithms.

Webpack 5 changes: Webpack 5 switched to using MD4 only when explicitly configured, and defaults to more secure hashing algorithms. This is why upgrading react-scripts (which bundles Webpack 5) resolves the issue.

Production builds: This error affects both development and production builds. If your CI/CD pipeline suddenly fails with this error, check the Node.js version being used in your build environment.

Performance impact of --openssl-legacy-provider: Using the legacy provider flag has minimal performance impact, but it re-enables deprecated cryptographic algorithms system-wide for your Node.js process. While acceptable as a temporary fix, upgrading your build tools is the more secure long-term approach.

Package-lock.json considerations: When upgrading react-scripts, you may need to delete node_modules and package-lock.json (or yarn.lock) and reinstall dependencies to ensure all transitive dependencies are properly updated.

ejected projects: If you've ejected from Create React App, you'll need to manually upgrade Webpack to version 5 in your package.json and update your webpack configuration accordingly. This is more complex than the solutions above.

Frequently asked questions

What does "0308010C" mean?
0) and older versions of Webpack (particularly Webpack 4). 0 deprecated and disabled several cryptographic algorithms by default, including the MD4 hash algorithm that Webpack 4 used in its build process for module hashing. 0.
How do I fix "0308010C"?
This error occurs when running Create React App projects with Node.js 17 or later due to breaking changes in OpenSSL 3.0. Webpack 4 (used by react-scripts 4.x) relies on the MD4 hashing algorithm, which is no longer supported by default in modern Node.js versions.
What causes "0308010C"?
Using Node.js 17 or later with react-scripts version 4.x or lower Webpack 4 attempting to use MD4 hashing algorithm that is no longer supported in OpenSSL 3.0 OpenSSL 3.0 deprecated legacy cryptographic algorithms for security reasons
Is the "0308010C" error serious?
Yes. This is a high-severity error that usually blocks work until it is fixed, but the steps above resolve it.

Official resources & further reading