How to Fix ERR_OSSL_EVP_UNSUPPORTED Error in Node.js

The error error:0308010C:digital envelope routines::unsupported (ERR_OSSL_EVP_UNSUPPORTED) in Node.js typically appears when building older projects (often with Webpack) on newer Node.js versions. It’s caused by OpenSSL 3 removing support for older algorithms. Here’s how to fix it properly.

Why This Happens

Node.js 17+ bundles OpenSSL 3, which disabled certain legacy algorithms (like the older MD4-based hashing) for security. Older versions of Webpack and some other tools used these now-unsupported algorithms internally (for module hashing). When they call the removed algorithm, OpenSSL 3 throws ERR_OSSL_EVP_UNSUPPORTED. It’s a compatibility gap between old tooling and new OpenSSL.

The Best Fix: Update Your Tooling

# The real fix is updating the tool that uses the legacy algorithm.
# For Webpack (the most common cause):
npm install webpack@latest webpack-cli@latest

# Newer Webpack (5.61+) uses a supported hashing algorithm.
# Also update related tools:
npm install react-scripts@latest   # if using Create React App
npm update                          # update dependencies generally

Updating to current tool versions is the proper solution — they use OpenSSL 3-compatible algorithms. The workarounds below are temporary bridges when you can’t update immediately.

Workaround 1: Legacy OpenSSL Provider Flag

# Set the NODE_OPTIONS environment variable to re-enable legacy algorithms

# macOS/Linux
export NODE_OPTIONS=--openssl-legacy-provider
npm run build

# Windows (Command Prompt)
set NODE_OPTIONS=--openssl-legacy-provider

# Windows (PowerShell)
$env:NODE_OPTIONS="--openssl-legacy-provider"

Workaround 2: In package.json Scripts (Cross-Platform)

// Add the flag directly to your scripts
{
  "scripts": {
    "build": "NODE_OPTIONS=--openssl-legacy-provider webpack",
    "start": "NODE_OPTIONS=--openssl-legacy-provider webpack serve"
  }
}

// For cross-platform (Windows + Unix), use cross-env:
// npm install --save-dev cross-env
{
  "scripts": {
    "build": "cross-env NODE_OPTIONS=--openssl-legacy-provider webpack"
  }
}

Workaround 3: Downgrade Node.js (Last Resort)

# If updating tooling isn't possible, use an older Node version
# with OpenSSL 1.1 (Node 16 or earlier)

# With nvm:
nvm install 16
nvm use 16
npm run build

# This is a temporary measure - Node 16 is old. Prefer updating
# your tooling to work with modern Node/OpenSSL.

Which Approach to Choose

The legacy provider flag is a quick unblock, but re-enabling deprecated algorithms isn’t ideal long-term. Prioritize updating your tooling when you can.

Verifying Your Versions

# Check your Node.js version (17+ has OpenSSL 3)
node --version

# Check OpenSSL version Node is using
node -e "console.log(process.versions.openssl)"
# 3.x.x means OpenSSL 3 (causes this error with old tools)

# Check Webpack version
npx webpack --version
# 5.61+ handles OpenSSL 3 correctly

Frequently Asked Questions

Q: What actually causes this error?
A: Node.js 17+ uses OpenSSL 3, which removed support for legacy algorithms (like an old MD4-based hash) that older Webpack versions used internally for module hashing. When the old tool calls the removed algorithm, OpenSSL 3 throws ERR_OSSL_EVP_UNSUPPORTED. It’s an incompatibility between old tooling and new OpenSSL.

Q: Is the –openssl-legacy-provider flag safe?
A: It re-enables deprecated algorithms that were disabled for security reasons. It’s a fine temporary workaround to unblock a build, but not ideal long-term. Prefer updating your tooling (Webpack) to use modern algorithms rather than relying on the legacy flag indefinitely.

Q: Why does updating Webpack fix it?
A: Newer Webpack (5.61+) switched to hashing algorithms supported by OpenSSL 3, so it no longer calls the removed legacy algorithm. Updating your build tooling to current versions is the proper fix — they’re compatible with modern Node.js and OpenSSL.

Q: Should I downgrade Node.js to fix this?
A: Only as a last resort if you can’t update tooling. Node 16 (OpenSSL 1.1) avoids the error but is old and unsupported. It’s better to update your tooling and stay on a current Node version. Downgrading is a temporary bridge, not a solution.

Q: I updated Webpack but still get the error. Why?
A: Another tool in your build chain may use the legacy algorithm (react-scripts, an old loader, etc.). Update all build-related dependencies, delete node_modules and reinstall. If it persists, use the legacy flag temporarily while identifying which dependency needs updating.

Conclusion

ERR_OSSL_EVP_UNSUPPORTED (digital envelope routines::unsupported) occurs when older tooling (usually Webpack) calls legacy algorithms that OpenSSL 3 (bundled in Node 17+) removed for security. The proper fix is updating your tooling (npm install webpack@latest and related build dependencies) to versions that use OpenSSL 3-compatible algorithms. As a quick temporary unblock, use the --openssl-legacy-provider flag via NODE_OPTIONS (with cross-env for cross-platform scripts), but treat it as a bridge, not a permanent solution. Downgrading Node.js works but keeps you on old, unsupported versions. Prioritize updating your build tools to work with modern Node.js — the legacy flag re-enables deprecated algorithms and shouldn’t be relied on long-term.