The error, verbatim
Jump to the fix ↓Error: error:0308010C:digital envelope routines::unsupported
opensslErrorStack: [
'error:03000086:digital envelope routines::initialization error',
'error:0308010C:digital envelope routines::unsupported'
],
library: 'digital envelope routines',
code: 'ERR_OSSL_EVP_UNSUPPORTED'
Tested on
- Node
- 16.20.2, 18.20.8, 20.20.2, 22.23.4, 24.22.1, 26.13.0 (Linux); 24.14.0 (Windows)
- webpack
- 4.46.0, 4.47.0 (with webpack-cli 3)
- Create React App
- react-scripts 4.0.3 (webpack 4.44.2), 5.0.1 (webpack 5.112.2)
- OS
- Ubuntu on GitHub Actions; Windows 11 Pro
✓ Last re-run on GitHub Actions · see the run · all repros
Contents
This error comes from webpack 4 asking Node for the md4 hash, which OpenSSL 3 no longer allows. The same build on six Node versions:
| Node (OpenSSL) | webpack 4.46.0 | Create React App 4 (react-scripts 4.0.3) |
|---|---|---|
| 16.20.2 (1.1.1) | ✅ builds | not tested |
| 18.20.8 (3.0) | ❌ 0308010C | not tested |
| 20.20.2 (3.0) | ❌ 0308010C | not tested |
| 22.23.4 (3.5) | ❌ 0308010C | ❌ 0308010C |
| 24.22.1 (3.5) | ❌ 0308010C | ❌ 0308010C |
| 26.13.0 (3.5) | ❌ 0308010C | ❌ 0308010C |
So every Node from 18 on throws it, and newer Node doesn’t help. Which fix works depends on whether you control the webpack version, or a tool like Create React App does.
The fix
Your own webpack 4 setup: upgrade to 4.47.0
You don’t have to jump to webpack 5. The last webpack 4 release handles this itself:
npm install -D webpack@4.47.0If you can’t change the webpack version, set the hash function in webpack.config.js instead:
module.exports = {
output: { hashFunction: 'sha256' },
};Create React App 4: upgrade to react-scripts 5
react-scripts 4.0.3 pins webpack 4.44.2. Forcing 4.47.0 does not fix it here:
- With
"overrides": { "webpack": "4.47.0" }inpackage.json, the build stops at CRA’s own check:The react-scripts package provided by Create React App requires a dependency: "webpack": "4.44.2". - With that check turned off (
SKIP_PREFLIGHT_CHECK=true), webpack 4.47.0 is used and the build still fails witherror:0308010C, so swapping webpack alone isn’t enough inside CRA 4.
The real fix is react-scripts 5, which uses webpack 5:
npm install react-scripts@5.0.1Fallback: the legacy OpenSSL provider
# macOS / Linux
NODE_OPTIONS=--openssl-legacy-provider npm run build# Windows PowerShell
$env:NODE_OPTIONS = "--openssl-legacy-provider"; npm run buildIt works, but it re-enables old, weaker algorithms for the whole Node process. Treat it as a stopgap, not the fix.
Long term
Move to webpack 5 or a current build tool. Webpack 4 no longer gets updates, and 4.47.0 is its final release.
Why it happens
Webpack 4 hashes files with the md4 algorithm through Node’s crypto. Node 17 switched to OpenSSL 3, which disables legacy algorithms like md4 by default. Asking for it fails with 0308010C: digital envelope routines::unsupported. The final webpack 4 release added its own md4 implementation, so it no longer asks OpenSSL for it. That is why the fix above works without any flag.
What didn’t work
How this was tested
September 2026: webpack 4.46.0 and 4.47.0 with webpack-cli 3 on Node 24.14.0, Windows 11 Pro. November 1, 2026: a one-file webpack 4 build on Node 16.20.2, 18.20.8, 20.20.2, 22.23.4, 24.22.1 and 26.13.0 on GitHub Actions ubuntu-latest, with 4.46.0, 4.47.0, the legacy flag and hashFunction: 'sha256'; and a minimal Create React App on Node 22, 24 and 26 with react-scripts 4.0.3 (plain, with the flag, with webpack overridden to 4.47.0) and react-scripts 5.0.1. The script and the full output are public.
— N.K., end of entry No.004