webpack ERR_OSSL_EVP_UNSUPPORTED (Node 17+) - Working Fixes

By Kaveh Alemi·Latchkey

Node 17+ ships OpenSSL 3, which removed the legacy MD4 hashing that older Webpack 4 (and some loaders) use internally. The build crashes with an OpenSSL "unsupported" error that has nothing to do with your code.

What this error means

A build that passed on Node 16 fails after a Node upgrade with error:0308010C:digital envelope routines::unsupported / ERR_OSSL_EVP_UNSUPPORTED. It appears immediately at hashing time, on every run, only on Node 17 and newer.

Error: error:0308010C:digital envelope routines::unsupported
    at new Hash (node:internal/crypto/hash:69:19)
    at Object.createHash (node:crypto:133:10)
library: 'digital envelope routines', reason: 'unsupported', code: 'ERR_OSSL_EVP_UNSUPPORTED'

Diagnose it: is it resolution, transform, or memory?

Bundler failures in CI fall into three families and the error text often points at the wrong one. A module that resolves on your machine and not on the runner is nearly always case sensitivity or a missing optional dependency; a transform error is a config or version mismatch; and an unexplained kill with no stack is the out-of-memory reaper, not a build error at all.

# 1. resolution: does the file exist with EXACTLY that case?
git ls-files | grep -i "the/imported/path"

# 2. transform: what versions is CI actually resolving?
npm ls webpack vite rollup esbuild typescript 2>/dev/null | head -20

# 3. memory: was it killed rather than failed?
#    exit 137 = SIGKILL (OOM). Nothing in the bundler log will explain it.
node --max-old-space-size=4096 node_modules/.bin/vite build

Common causes

OpenSSL 3 on Node 17+ vs legacy hashing

Webpack 4 (and tools built on it, like older create-react-app and vue-cli) hash modules with MD4. OpenSSL 3 disables it by default, so the hash call throws ERR_OSSL_EVP_UNSUPPORTED.

Runner Node bumped without bumping the toolchain

CI moved to a newer Node image while the project still depends on Webpack 4-era tooling that has not been upgraded.

How to fix it

Enable the OpenSSL legacy provider (quick unblock)

Set NODE_OPTIONS so Node re-enables the legacy hashing the old toolchain needs.

export NODE_OPTIONS=--openssl-legacy-provider
npm run build
# package.json (cross-env for portability):
# "build": "cross-env NODE_OPTIONS=--openssl-legacy-provider webpack"

Upgrade the toolchain (durable fix)

1. Move to Webpack 5 (or a framework version built on it), which hashes with a supported algorithm.
2. Remove the --openssl-legacy-provider flag once the build no longer needs it.
3. As a stopgap only, pin the runner to Node 16 - not a long-term answer.

Make the build reproducible before you debug it

• Pin the Node major in setup-node and in engines. A bundler that resolves native bindings will pick a different prebuilt binary across majors.
• Delete node_modules locally and reinstall from the lockfile before concluding the runner is at fault; most "works locally" reports are stale local state.
• Set CI=true locally to reproduce. Several toolchains change behaviour under it, including treating warnings as errors.
• Exit code 137 is an out-of-memory kill. Raise --max-old-space-size or move to a larger runner rather than searching the bundler config.

How to prevent it

• Keep webpack and framework tooling on versions compatible with current Node/OpenSSL.
• Test the build before bumping the CI Node image.
• Treat --openssl-legacy-provider as temporary and schedule the upgrade that removes it.

Frequently asked questions

Related guides

References

• Node.js documentation
• npm CLI documentation
• GitHub Actions documentation