node 17+ · npm
The message
Error: error:0308010C:digital envelope routines::unsupported
What it means
node 17 shipped OpenSSL 3, which dropped an old hash algorithm from the defaults, and a tool that still asks for it falls over right inside that hash call. It is almost always an old webpack 4, or a tool that bundles one, running on a modern node. export NODE_OPTIONS=--openssl-legacy-provider re-enables the legacy algorithms for that process and is harmless for a build. But it is keeping a dead tool alive: upgrading to webpack 5, or to the current version of your framework, removes the need for the flag entirely.
The fix
export NODE_OPTIONS=--openssl-legacy-provider- Printed by
- node 17+
- npm
- 20
With npm the cause sits in the first code XXXX line rather than the last six npm ERR! lines, and when the failure comes from the dependency tree or a native build instead of your own code, deleting node_modules and installing again clears about half of them.
Reading an error message
- Read from the first line down. The lower you go the more it is about the tool’s internals; the cause is usually at the top.
- If there is a file and a line number, start there — not the top stack frame, but the topmost line that names a file you wrote.
- Search the message verbatim, but strip your own paths and variable names first; those are what stop the search from matching.
- The same condition is worded differently across tool versions. If results look wrong, add the version number to the query.
- Before pasting a fix, check what it throws away. Some of these cannot be undone.
Common questions
Q. What does “Error: error:0308010C:digital envelope routines::unsupported” mean?
node 17 shipped OpenSSL 3, which dropped an old hash algorithm from the defaults, and a tool that still asks for it falls over right inside that hash call. It is almost always an old webpack 4, or a tool that bundles one, running on a modern node. export NODE_OPTIONS=--openssl-legacy-provider re-enables the legacy algorithms for that process and is harmless for a build. But it is keeping a dead tool alive: upgrading to webpack 5, or to the current version of your framework, removes the need for the flag entirely.
Q. How do I fix it?
export NODE_OPTIONS=--openssl-legacy-provider — before running it, check the explanation above for what this command discards.
Q. Which tool prints this?
node 17+. It sits under npm, and the message runs to 4 words.