Error:error:0308010C:digital envelope routines::unsupported

If you are running Webpack or a CLI tool that’s built on top of Webpack (e.g., 

 applications) with version 17 of Node.js, then you may have come across the following error:

Error: error:0308010C:digital envelope routines::unsupported

, algorithms like MD4 have been relegated to OpenSSL 3.0’s legacy provider. A 

 is a collection of cryptographic algorithm implementations. OpenSSL 3.0 comes with 

: default, legacy, FIPS, base and null. The legacy provider consists of algorithms that are considered to be rarely used in today’s world or unsafe security-wise. This provider exists for backwards compatibility purposes (for software that still rely on these algorithms) and is not loaded by default.

 module. This method can only create hashes with algorithms that are available and supported by the version of OpenSSL corresponding to the currently installed Node.js version. Since Webpack specifies to the 

 method to use the MD4 algorithm (see below code), and this algorithm is not readily available in Node.js v17+ due to OpenSSL 3.0 not loading legacy providers by default, Webpack errors out and Node.js logs the error message 

https://github.com/webpack/webpack/blob/main/lib/util/createHash.js

// ...

/**
 * Creates a hash by name or function
 * @param {string | typeof Hash} algorithm the algorithm name or a constructor creating a hash
 * @returns {Hash} the hash
 */
module.exports = algorithm => {
  if (typeof algorithm === "function") {
    return new BulkUpdateDecorator(() => new algorithm());
  }
  switch (algorithm) {
    // TODO add non-cryptographic algorithm here
    case "debug":
      return new DebugHash();
    case "xxhash64":
      if (createXXHash64 === undefined) {
        createXXHash64 = require("./hash/xxhash64");
        if (BatchedHash === undefined) {
          BatchedHash = require("./hash/BatchedHash");
        }
      }
      return new BatchedHash(createXXHash64());
    case "md4":
      if (createMd4 === undefined) {
        createMd4 = require("./hash/md4");
        if (BatchedHash === undefined) {
          BatchedHash = require("./hash/BatchedHash");
        }
      }
      return new BatchedHash(createMd4());
    case "native-md4":
      if (crypto === undefined) crypto = require("crypto");
      return new BulkUpdateDecorator(() => crypto.createHash("md4"), "md4");
    default:
      if (crypto === undefined) crypto = require("crypto");
      return new BulkUpdateDecorator(
        () => crypto.createHash(algorithm),
        algorithm
      );
  }
};

To fix this error, you can do one of five things:

Downgrade Your Machine’s Installed Version of Node.js to 16 or Below

, then you can install Node.js v16. Once the installation finishes, nvm automatically switches the current version of Node.js to the newly installed version of Node.js. 

: Specifying 16 installs the latest LTS version with a major version of 16, which happens to be, as of the publication of this article, 16.16.0. 

: The Node.js version can be any version less than 17, but it's highly recommended to stick with Node.js versions that are under 

 to verify the versions of Node.js and npm running on your machine.

 folder and re-install the project's dependencies.

Similarly, if you are running Node.js via 

, then you can also install Node.js v16 the same way.

: For convenience, you can save this exact version of Node.js and npm to the project via the 

 command. Anytime you enter the project directory and run Node.js, Volta automatically switches the current version of Node.js to the pinned version of Node.js.

 Flag to Webpack or the Webpack-Based CLI Tool

 flag tells Node.js to revert to OpenSSL 3.0's legacy provider. This allows you to run tools like Webpack that still create hashes with legacy cryptographic algorithms like MD4.

Here are some examples of how to pass this flag:

If you have multiple CLI tools that depend on legacy cryptographic algorithms, then you can set the 

For MacOSX and Unix, run the following command before running anything else:

$ export NODE_OPTIONS=--openssl-legacy-provider

For Windows, run the following command before running anything else:

$ set NODE_OPTIONS=--openssl-legacy-provider

Alternatively, you could set the environment variable directly within an npm script of a 

{
  "scripts": {
    "start": "NODE_OPTIONS=--openssl-legacy-provider npm-run-all ..."
  }
}

, all of the executed npm scripts receive the 

: For cross-platform compatibility, set the environment variable via a CLI tool like 

For an older Create React App project that runs 

), there are three files across two dependencies that use the MD4 algorithm for creating hashes:

Upon patching these files, the Create React App application runs successfully with Node.js v17+. However, this approach is highly discouraged. You would need to:

For a Webpack project, you can apply the following patch to redirect requests for creating hashes with the MD4 algorithm to creating hashes with the MD5 algorithm instead, like so:

// ...

// Note: Added the `loadCrypto()` function to override the `crypto` module's `createHash()` method. If the "md4" algorithm gets passed to the `createHash()` method, then call the `createHash()` method with the "md5" algorithm instead.
function loadCrypto() {
  const c = require("crypto");
  const originalCreateHash = c.createHash;

  c.createHash = (...args) => {
    if (args[0] == 'md4') {
      return originalCreateHash('md5');
    }
  
    return originalCreateHash(...args);
  };

  return c;
}

/**
 * Creates a hash by name or function
 * @param {string | typeof Hash} algorithm the algorithm name or a constructor creating a hash
 * @returns {Hash} the hash
 */
module.exports = algorithm => {
  if (typeof algorithm === "function") {
    return new BulkUpdateDecorator(() => new algorithm());
  }
  switch (algorithm) {
    // TODO add non-cryptographic algorithm here
    case "debug":
      return new DebugHash();
    case "xxhash64":
      if (createXXHash64 === undefined) {
        createXXHash64 = require("./hash/xxhash64");
        if (BatchedHash === undefined) {
          BatchedHash = require("./hash/BatchedHash");
        }
      }
      return new BatchedHash(createXXHash64());
    case "md4":
      if (createMd4 === undefined) {
        createMd4 = require("./hash/md4");
        if (BatchedHash === undefined) {
          BatchedHash = require("./hash/BatchedHash");
        }
      }
      return new BatchedHash(createMd4());
    case "native-md4":
      if (crypto === undefined) crypto = loadCrypto(); // Note: Replaced `require("crypto").createHash(algorithm)` with `loadCrypto().createHash(algorithm)`. 
      return new BulkUpdateDecorator(() => crypto.createHash("md4"), "md4");
    default:
      if (crypto === undefined) crypto = loadCrypto(); // Note: Replaced `require("crypto").createHash(algorithm)` with `loadCrypto().createHash(algorithm)`. 
      return new BulkUpdateDecorator(
        () => crypto.createHash(algorithm),
        algorithm
      );
  }
};

 module via the above solution was originally 

For Create React App projects, check the installed version of 

. If the version is less than v5.0.0, then upgrade the version of 

 of Create React App, the version of the cached Webpack modules and chunks gets 

generated using a stringified object of environment variables and MD5 algorithm

https://github.com/facebook/create-react-app/blob/main/packages/react-scripts/config/webpack/persistentCache/createEnvironmentHash.js

'use strict';
const { createHash } = require('crypto');

module.exports = env => {
  const hash = createHash('md5');
  hash.update(JSON.stringify(env));

  return hash.digest('hex');
};

Want to learn about Vue 3, the Composition API and building real-world, production-ready applications with Vue 3? Check out our book 

Learn

The newline Guide to Building Your First GraphQL Server with Node and TypeScript

Teach

Amelia Wattenberger

Author of Fullstack D3

Community

How to Fix the Error Error:error:0308010C:digital envelope routines::unsupported

Responses (0)

Masterclasses

Tutorials

Fullstack React with TypeScript