Fixing the Node.js 'digital envelope routines::unsupported' Error (OpenSSL 3.0)

What Happened?You probably just upgraded your local environment to Node.js v18 or v20, expecting a performance boost. Instead, your legacy React project crashed the second you ran npm start. This specific error usually appears when older build tools meet the stricter security standards of modern Node.js versions.

Error: error:0308010C:digital envelope routines::unsupported
    at new Hash (node:internal/crypto/hash:71:19)
    at Object.createHash (node:crypto:133:10)
    at /node_modules/webpack/lib/util/createHash.js:135:53

Why Your Build BrokeThe trouble started with Node.js v17. That version swapped out OpenSSL 1.1.1 for OpenSSL 3.0. This newer security layer is much more opinionated. It moves older, insecure algorithms like MD4 into a "legacy" provider that is disabled by default.

Weback 4 and older versions of Create React App (v4 and below) use MD4 to generate file hashes. When these tools try to call the hashing function, OpenSSL 3.0 blocks the request because it doesn't recognize the routine as "safe" anymore. The result? Your build process dies instantly.

The Quick Fix: Environment VariablesIf you are on a tight deadline, you can force Node.js to use the legacy provider. This bypasses the strict security check without requiring any code changes. It's a reliable band-aid for local development.

On Linux or macOSRun this command in your terminal before starting your project:

export NODE_OPTIONS=--openssl-legacy-provider
npm start

On Windows (Command Prompt)```

set NODE_OPTIONS=--openssl-legacy-provider npm start

### On Windows (PowerShell)```
$env:NODE_OPTIONS = "--openssl-legacy-provider"
npm start

The Better Way: Update package.jsonManually typing export commands is a chore. It's better to automate this in your package.json so your teammates don't run into the same wall. However, since different operating systems handle environment variables differently, the cross-env package is the safest bet.

First, install the helper:

npm install cross-env --save-dev

Next, update your scripts section. This ensures the fix works on Windows, Mac, and Linux seamlessly:

{
  "scripts": {
    "start": "cross-env NODE_OPTIONS=--openssl-legacy-provider react-scripts start",
    "build": "cross-env NODE_OPTIONS=--openssl-legacy-provider react-scripts build"
  }
}

The Long-Term Solution: Upgrade Your StackThe environment variable fix is technically a workaround. You are still using deprecated algorithms. If you have the time, the "proper" solution is to move to tools that support OpenSSL 3.0 natively.

• Upgrade Webpack: Move to Webpack 5.20.0 or higher. This version allows you to change the hashing algorithm to xxhash64, which is faster and compatible.
• Upgrade CRA: If you use Create React App, move to react-scripts v5.0.0+.
• Use NVM: If you can't upgrade the project, use Node Version Manager to switch back to Node.js v16.14.0 (LTS). This version uses the older OpenSSL 1.1.1 and won't throw this error.

nvm install 16
nvm use 16

Fixing Docker & CI/CDIf your Jenkins or GitHub Actions pipeline is failing, add the flag to your Dockerfile. This prevents the build from crashing in your containerized environment:

# Use the flag during the build process
ENV NODE_OPTIONS=--openssl-legacy-provider
RUN npm run build

How to Verify the FixDon't just assume it works. Follow these steps to confirm:

• Delete your node_modules/.cache folder to clear out old build artifacts.
• Execute npm run build.
• Check your /build or /dist folder. If files are generated and the terminal says "Compiled successfully," you're good to go.
• Run node --help | grep openssl-legacy-provider. If it returns a result, your current Node version recognizes the flag.