How to fix error:0308010C:digital envelope routines::unsupported on NodeJS

When running JavaScript applications with Node, you might see the following error:

Error: error:0308010C:digital envelope routines::unsupported

After some research, I found this error occurs because there’s a breaking change in Node.js version 17, which used OpenSSL version 3 by default.

This article explains why this error occurs and several ways you can fix it in practice.

Why this error occurs

Command line tools like Webpack uses the “MD4 algorithm” to create file hashes. These file hashes are then used to keep track of changes in your JavaScript files.

By default, OpenSSL version 3 didn’t enable the MD4 algorithm support. If you upgraded Node.js to version 17 and above, you’ll see this error when building an application using Webpack.

For example, this error appears when running a React application:

$ npm start
Starting the development server...

Error: error:0308010C:digital envelope routines::unsupported

Near the end of the terminal, you should see opensslErrorStack logs similar to this:

{
  opensslErrorStack: [ 'error:03000086:digital envelope routines::initialization error' ],
  library: 'digital envelope routines',
  reason: 'unsupported',
  code: 'ERR_OSSL_EVP_UNSUPPORTED'
}

The error stack is confusing because nothing in it points to the MD4 algorithm which is not enabled by default in OpenSSL 3. I only found out by reading discussions on GitHub.

It doesn’t matter whether you run a React, Vue, Angular, or any other application. You’ll get this error because the Webpack build failed.

1. To fix this error, you need to upgrade to Webpack 5

The fix for this error is released in Webpack 5.61.0, in which the maintainer sokra added an MD4 implementation using Web Assembly.

If you’re using Webpack directly in your package.json file, then you can upgrade Webpack to version 5:

npm install webpack@latest

Unfortunately, if Webpack is used internally by your developer tool (like Create React App and vue-cli) then you can’t upgrade Webpack version like this.

You need to wait until the tool released a new version that fix this error, or you can use one of the solutions below.

2. Add --openssl-legacy-provider flag to your build script

As an alternative solution, you can add the --openssl-legacy-provider flag to the build script defined in package.json.

The Open SSL legacy provider is a collection of legacy algorithms that are no longer in common use, such as MD2, MD4, MDC2, etc.

You can add the flag to enable these legacy algorithms. Here are some examples for Create React App and vue-cli apps:

// For React:
{
  "scripts": {
    "start": "react-scripts start --openssl-legacy-provider"
  }
}

// For Vue:
{
  "scripts": {
    "serve": "vue-cli-service serve --openssl-legacy-provider"
  },
}

If you see an error saying Error: Unknown argument: openssl-legacy-provider, then you can set the NODE_OPTIONS environment variable before running the build command.

Depending on your terminal, run one of the commands below:

# macOS, Linux and Windows Git Bash
export NODE_OPTIONS=--openssl-legacy-provider

# Windows Command Prompt:
set NODE_OPTIONS=--openssl-legacy-provider

# Windows PowerShell:
$env:NODE_OPTIONS="--openssl-legacy-provider"

Then run your build command, for example:

export NODE_OPTIONS=--openssl-legacy-provider
npm start

With the legacy provider enabled, the error should disappear.

3. If you use Create React App, upgrade react-scripts to v5

If you use Create React App, then you can fix this error by upgrading react-scripts to v5.

You can run one of the following commands:

# For npm:
npm install react-scripts@5

# For Yarn:
yarn add react-scripts@5

The react-scripts package now uses the MD5 algorithm to generate Webpack modules and chunks.

The error should disappear when you run the npm start command.

4. Downgrade to Node v16

If you have a complex application, then upgrading Webpack to version 5 can be quite difficult.

You can downgrade your Node.js to version 16 as you prepare a migration plan from version 4 to version 5.

If you use nvm, then you can run the following commands to install and use Node v16:

nvm install 16
nvm alias default 16
nvm use 16

# Check node version:
node -v

If you use Volta, run the commands below:

volta install node@16

# Check node version:
node -v

Volta automatically set the default node version to the most recently installed.

Next, you need to delete the node_modules folder and run npm install so that all dependencies on your package get rebuilt using Node v16. Some dependencies may cause other errors when build with a different Node version.

Although this fix works, keep in mind that you eventually need to upgrade to Node v18 when Node v16 reached the end of life in September 2023.

You should create a migration plan to upgrade Webpack to version 5 in the meantime.

Summary

The error 0308010c:digital envelope routines::unsupported occurs because Webpack used the MD4 algorithm in its build process, which is no longer supported by default in the latest Node.js version.

To resolve this error, you need to upgrade Webpack to version 5 which implements its own MD4 algorithm without depending on Node’s implementation. If you can’t upgrade Webpack yet, you need to add the --openssl-legacy-provider flag when starting the Node server.

The error is somewhat frustrating because it’s not clear what you should do, but at least the fix is easy to implement.

I hope this tutorial helps. Thanks for reading and Happy coding! 🙌