Error: error:0308010C:digital envelope routines::unsupported

Node.js · updated 2026-11-04

Thrown by crypto.createHash or a cipher call when the algorithm isn't available in Node's OpenSSL 3 (Node 17 and later). Most often it happens during a build or dev server start, from webpack 4 or a tool built on it (react-scripts 4, Vue CLI 4, older Storybook), right after a Node upgrade. It can also happen at runtime when your own code asks for MD4 or a legacy cipher.

Error: error:0308010C:digital envelope routines::unsupported
    at new Hash (node:internal/crypto/hash:69:19)
    at Object.createHash (node:crypto:133:10)
    at module.exports (/app/node_modules/webpack/lib/util/createHash.js:135:53)
    at NormalModule._initBuildHash (/app/node_modules/webpack/lib/NormalModule.js:417:16) {
  opensslErrorStack: [ 'error:03000086:digital envelope routines::initialization error' ],
  library: 'digital envelope routines',
  reason: 'unsupported',
  code: 'ERR_OSSL_EVP_UNSUPPORTED'
}

Quick fix

Look at the first stack frame below node:crypto. If it is webpack, upgrade to webpack 5.61 or later (or react-scripts 5), which no longer needs MD4 from OpenSSL. If you cannot upgrade yet, set NODE_OPTIONS=--openssl-legacy-provider for the build as a stopgap. If it is your own code, switch to a current algorithm such as sha256.

Find the first frame under node:crypto in the stack: webpack, another package, or your code.
webpack 4 or react-scripts 4: upgrade to webpack 5.61+ or react-scripts 5.
Can't upgrade today: run the build with NODE_OPTIONS=--openssl-legacy-provider and plan the upgrade.
Your own code: replace createHash('md4') or legacy ciphers (DES, RC4) with sha256 or aes-256-gcm.
Check the Node version in CI and in the Docker image too: the error appears wherever Node is 17 or newer.

json

{
  "scripts": {
    "build": "NODE_OPTIONS=--openssl-legacy-provider react-scripts build"
  }
}

Why it happens

webpack 4 hashes modules with MD4

webpack 4 calls crypto.createHash('md4') for module and chunk hashes. OpenSSL 3 moved MD4 to its legacy provider, so the call fails as soon as the build starts on Node 17+. webpack 5.61.0 switched to its own WebAssembly MD4.

A tool pinned to webpack 4

react-scripts 4, Vue CLI 4 and older Storybook and Gatsby versions bundle webpack 4, so the error shows up even though your own package.json never mentions webpack.

Node upgraded under the project

A new CI image, Docker base image or nvm default moved the project from Node 16 to 18 or later with no code change.

Legacy algorithms in your own code

createHash with md4 or a cipher such as des or rc4, or a private key in an old format, fails the same way at runtime.

Other fixes

Pin Node 16 only as a last resort: it is past end of life and gets no security fixes.
On webpack 5.54 to 5.60, set output.hashFunction to 'xxhash64' to stop using MD4.

Same error, other wording

Error: error:0308010C:digital envelope routines::unsupported (code: 'ERR_OSSL_EVP_UNSUPPORTED')
opensslErrorStack: [ 'error:03000086:digital envelope routines::initialization error' ]
Error: error:03000086:digital envelope routines::initialization error

Let your coding agent catch the next one

Runheed records this error in production with the stack trace, the breadcrumbs before it and the agent session that shipped the code, and serves it to Claude Code, Cursor or any MCP client. With it connected, you can ask:

> Find the ERR_OSSL_EVP_UNSUPPORTED errors, tell me which package calls crypto.createHash in the stack, and upgrade it (or set --openssl-legacy-provider only where the build needs it, with a note to remove it).

Plans from $29/mo See what your agent reads See the setupCancel any time from the billing portal

Related errors

More in Memory, async and the process

References: Node.js 17.0.0 release notes (OpenSSL 3, ERR_OSSL_EVP_UNSUPPORTED), Node.js CLI docs: --openssl-legacy-provider, webpack issue 14532: Node 17 digital envelope routines::unsupported, webpack v5.61.0 release (wasm MD4 for Node 17)