Error: error:0308010C:digital envelope routines::unsupported

The exact error string

Error: error:0308010C:digital envelope routines::unsupported
    at new Hash (node:internal/crypto/hash:69:19)
    at Object.createHash (node:crypto:138:10)
    ...
  opensslErrorStack: [ 'error:03000086:digital envelope routines::initialization error' ],
  library: 'digital envelope routines',
  reason: 'unsupported',
  code: 'ERR_OSSL_EVP_UNSUPPORTED'

The giveaway is the call stack: createHash → new Hash. A tool asked OpenSSL for a hash algorithm OpenSSL 3 will not provide by default. In a frontend project that algorithm is almost always MD4, used by webpack to fingerprint modules and chunks.

Why upgrading Node triggered it

Node.js 17 replaced its bundled OpenSSL 1.1.1 with OpenSSL 3.0. OpenSSL 3 moved a set of old, weak algorithms — including MD4 — into a separate "legacy provider" that is not loaded by default. Webpack 4 calls crypto.createHash('md4'), which used to succeed and now throws. Nothing in your code changed; the crypto library underneath Node did.

This is the same class of "Node upgrade broke the build" issue as switching module systems — see Cannot use import statement outside a module — and the principle is the same: align the toolchain with the runtime.

Fix 1: upgrade the build tool (recommended)

Webpack 5.61+ stopped using MD4 and now uses a hash that works on OpenSSL 3; react-scripts 5 carries that fix for Create React App. Updating is the only option that removes the error without re-enabling deprecated crypto:

# Create React App
npm install react-scripts@latest

# Plain webpack
npm install webpack@latest webpack-cli@latest

# then a clean install so the lockfile matches
rm -rf node_modules package-lock.json
npm install

If a deep dependency still pins old webpack, check its release notes for an OpenSSL-3-compatible version, or use an overrides entry to lift it — the same technique covered in npm ERESOLVE.

Fix 2: the legacy-provider flag (stopgap)

When you can't upgrade right now, re-enable the legacy OpenSSL provider with an environment variable. It works immediately, but it keeps you on an old toolchain and turns deprecated algorithms back on, so treat it as a bridge:

# macOS / Linux (one-off)
export NODE_OPTIONS=--openssl-legacy-provider
npm run build

# Windows PowerShell (one-off)
$env:NODE_OPTIONS = "--openssl-legacy-provider"
npm run build

Fix 3: make the flag cross-platform in package.json

Hard-coding NODE_OPTIONS=... inline breaks on Windows. Install cross-env first (npm install -D cross-env), then wrap the scripts so one definition works everywhere:

{
  "scripts": {
    "start": "cross-env NODE_OPTIONS=--openssl-legacy-provider react-scripts start",
    "build": "cross-env NODE_OPTIONS=--openssl-legacy-provider react-scripts build"
  }
}

What not to do: downgrade Node

Dropping back to Node 16 makes the error disappear, but Node 16 is end-of-life and unsupported, so you trade a build error for missing security updates. Only do this as a very short-term unblock while you plan the upgrade — never as the resting state.

A note on the MD4 hash itself

The algorithm at the centre of this error, MD4, is used here only to name build artifacts — it secures nothing, which is why re-enabling it for a build is low-risk. For any real hashing need (checksums, content fingerprints, integrity checks) use a modern algorithm like SHA-256. You can compute SHA-256/SHA-1/MD5 hashes of text in your browser with the Hash Generator.

Debugging checklist

• ✓ Is the stack in createHash / new Hash? Then it's the OpenSSL 3 / MD4 issue
• ✓ Check node -v — 17+ means OpenSSL 3 is in play
• ✓ Upgrade webpack to 5.61+ or react-scripts to 5 (the real fix)
• ✓ Can't upgrade yet? Set NODE_OPTIONS=--openssl-legacy-provider
• ✓ Put it in package.json via cross-env for Windows compatibility
• ✓ Do a clean node_modules + lockfile reinstall after upgrading
• ✓ Avoid downgrading to the EOL Node 16 as a permanent fix