ERR_OSSL_EVP_UNSUPPORTED, explained and fixed

The full text usually reads Error: error:0308010C:digital envelope routines::unsupported, with the code ERR_OSSL_EVP_UNSUPPORTED. It appears when Node 17 or later runs tooling that asks OpenSSL for the MD4 hash. OpenSSL 3, which newer Node ships with, moved MD4 and other legacy algorithms out of the default provider, so the request fails. The classic trigger is an older webpack (version 4, and the Create React App versions built on it) hashing module content during a build on a modern Node.

Why it shows up when it does

  1. Nothing in the application code changed, the machine or CI image moved to a newer Node, and a previously working build started failing at the same step. That timing is the fingerprint of this error.
  2. The hashing happens inside the toolchain, webpack 4 and its loaders call MD4 for content hashes; the application never asks for MD4 directly.
  3. Development servers hit it too, npm start on an old Create React App fails the same way as npm run build, because both run webpack.

The fixes, in order of preference

  1. Upgrade the toolchain. webpack 5 (and current Create React App, Vue CLI, and Angular versions) does not depend on MD4. This is the durable fix and the only one that keeps working as Node advances.
  2. Use the legacy provider flag as a bridge: NODE_OPTIONS=--openssl-legacy-provider before the build command restores the legacy algorithms for that process. It works on official Node builds that include the legacy provider; some distro and hardened builds omit it, where the flag itself errors.
  3. Pin Node to an LTS line the toolchain supports (Node 16 for webpack 4 era projects) with a version manager or the project's .nvmrc, appropriate for a legacy project in maintenance, not for new work.
The legacy provider flag re-enables weak algorithms for that process, which is acceptable as a temporary build-machine measure and a poor permanent setting for a production server. Treat it as a bridge with an upgrade ticket attached, not as the fix.

Common questions

Is my Node installation broken? No. Node is working as designed; the toolchain is requesting an algorithm OpenSSL 3 no longer offers by default. The mismatch is between the build tool's age and the runtime's age.

Why did it break after a system update? The update brought a newer Node (or a Node built against system OpenSSL 3). The project and its lockfile did not change, the platform under them did.

Will --openssl-legacy-provider work on every machine? No. It requires the legacy provider to be present in the OpenSSL build. Official Node binaries include it; some Linux distribution builds and FIPS configurations do not, and there the only routes are upgrading the toolchain or using an older Node.

Related errors

Node: JavaScript heap out of memory · Node: Cannot find module · Cannot use import statement outside a module