2222

I created the default IntelliJ IDEA React project and got this:

Error: error:0308010C:digital envelope routines::unsupported
    at new Hash (node:internal/crypto/hash:67:19)
    at Object.createHash (node:crypto:130:10)
    at module.exports (/Users/user/Programming Documents/WebServer/untitled/node_modules/webpack/lib/util/createHash.js:135:53)
    at NormalModule._initBuildHash (/Users/user/Programming Documents/WebServer/untitled/node_modules/webpack/lib/NormalModule.js:417:16)
    at handleParseError (/Users/user/Programming Documents/WebServer/untitled/node_modules/webpack/lib/NormalModule.js:471:10)
    at /Users/user/Programming Documents/WebServer/untitled/node_modules/webpack/lib/NormalModule.js:503:5
    at /Users/user/Programming Documents/WebServer/untitled/node_modules/webpack/lib/NormalModule.js:358:12
    at /Users/user/Programming Documents/WebServer/untitled/node_modules/loader-runner/lib/LoaderRunner.js:373:3
    at iterateNormalLoaders (/Users/user/Programming Documents/WebServer/untitled/node_modules/loader-runner/lib/LoaderRunner.js:214:10)
    at iterateNormalLoaders (/Users/user/Programming Documents/WebServer/untitled/node_modules/loader-runner/lib/LoaderRunner.js:221:10)
/Users/user/Programming Documents/WebServer/untitled/node_modules/react-scripts/scripts/start.js:19
  throw err;
  ^

It seems to be a recent issue - webpack ran into this 4 days ago and is still working on it.

12

67 Answers 67

2695

You can try one of these:

1. Downgrade to Node.js v16.

  • You can reinstall the current LTS version from Node.js’ website.

  • You can also use nvm. For Windows, use nvm-windows.

2. Enable legacy OpenSSL provider.

On Unix-like (Linux, macOS, Git bash, etc.):

export NODE_OPTIONS=--openssl-legacy-provider

On Windows command prompt:

set NODE_OPTIONS=--openssl-legacy-provider

On PowerShell:

$env:NODE_OPTIONS = "--openssl-legacy-provider"

Reference

60
  • 25
    where do i put this?
    – a1cd
    Oct 25, 2021 at 20:13
  • 51
    For me this command fails /usr/local/Cellar/node/17.0.1/bin/node: --openssl-legacy-provider is not allowed in NODE_OPTIONS Nov 13, 2021 at 4:30
  • 36
    This solution is not recomended, try to uninstall Node.js version 17+ and reinstall the Node.js version 16+. Nov 24, 2021 at 8:30
  • 20
    did set NODE_OPTIONS=--openssl-legacy-provider It's giving the same error Nov 25, 2021 at 20:57
  • 12
    Downgrading to 16.13.0 is not enough, and it still won't let you use --openssl-legacy-provider. To use this parameter, you must be on v17 and up, and the parameter must be placed inside your package.json, it won't allow you to just place it in the NODE_OPTIONS env var for security reasons. And then it still doesn't work. This will only become a bigger problem as more people move onto the v16 LTS as a lot of projects still depend on Webpack 4 Feb 27, 2022 at 23:21
1397

Danger

This question has more than 30 answers, most suggesting to either downgrade Node.js to pre v17 or to use the legacy SSL provider. Both of those solutions are hacks that leave your builds open to security threats.

Reason For The Error

In Node.js v17, the Node.js developers closed a security hole in the SSL provider. This fix was a breaking change that corresponded with similar breaking changes in the SSL packages in NPM. When you attempt to use SSL in Node.js v17 or later without also upgrading those SSL packages in your package.json, then you will see this error.

The Correct (safe) Solution (for npm users)

Use an up-to-date version of Node.js, and also use packages that are up-to-date with security fixes.

You can first try an update to see if that solves the problem:

npm update

If that is not enough, for many people, the following command will fix the issue:

npm audit fix --force

However, be aware that, for complex builds, the above command will pull in breaking security fixes that can potentially break your build.

Note for Yarn users

Yarn users can use yarn-audit-fix which can be run without installing as a dependency via

npm_config_yes=true npx yarn-audit-fix

or windows powershell:

$env:npm_config_yes = 1; npx yarn-audit-fix

A less heavy-handed (also correct) solution for Webpack

In your Webpack config, set either of the following: (See the ouput.hashFunction docs)

A. (Webpack v5) Set output.hashFunction = 'xxhash64'.
B. (Webpack v4) This will depend on what hash algorithms nodejs supports on your system. Some common options you can try are output.hashFunction = 'sha512' or output.hashFunction = 'sha256'.

See more info in Greg's answer.

34
  • 34
    npm audit fix --force is the only thing that worked for me, but I also had to upgrade all package dependencies in my project first: nodejs.dev/en/learn/… Sep 8, 2022 at 5:16
  • 9
    @vanowm, the audit fix --force upgrades packages in a more heavy-handed way than a regular upgrade. The --force flag upgrades even breaking changes, which is what many (perhaps most?) of us who have this problem need to fix the problem (unless using the less heavy-handed option mentioned in Greg's answer).
    – David
    Oct 9, 2022 at 22:28
  • 13
    @David, in my case using npm update what fixed it, the npm audit fix --force prior that did nothing...just saying.
    – vanowm
    Oct 15, 2022 at 11:31
  • 77
    Thank you for the actually sane answer, David. I'm shocked at the number of answers that suggest downgrading node. Nov 2, 2022 at 17:17
  • 9
    If you're using YARN, you'll need to use npm to use this fix, here is some documentation that helps: stackoverflow.com/a/60878037/2391795 Jan 9, 2023 at 16:51
1125

In your package.json: change this line

"start": "react-scripts start"

to

"start": "react-scripts --openssl-legacy-provider start"
16
  • 158
    but note that --openssl-legacy-provider means you are now almost certainly running with known insecure SSL, so this might mitigate the symptom, but it probably doesn't fix the underlying problem. Oct 25, 2021 at 21:29
  • 10
    But of cause, this is acceptable when running localhost. In the newly released VS 2022, starting a react-app from scratch, having VS 2022 creating a self-signed certificate for you, still causes the sample project to crash. This is also an issue when creating a react-project from scratch using NPM commandline "npx create-react-app react-core-test". I testet this in two distinct environments runnin WIndows 10 and Windows 11. Dec 3, 2021 at 10:29
  • 32
    I don't understand the implication that, somehow, using node 16 with openssl 1.x would be more secure than using node 17 with openssl 3 in legacy mode. OpenSSL made something stricter in v3. You're either defeating that restriction one way, or the other. Both approaches are probably equally insecure.
    – kojiro
    Dec 8, 2021 at 16:58
  • 11
    This has been solved in react-scripts 5: stackoverflow.com/a/71334532/2525299 Mar 3, 2022 at 9:11
  • 5
    I needed to do a npm audit fix --force first to get this working.
    – theking2
    May 10, 2023 at 13:07
259

If we use the current LTS version of Node.js then this error will not come. Downgrade your Node.js version to the current LTS version (16.13.0).

There can be multiple ways to install the required version. One of them is using nvm (Node.js version manager).

14
  • 49
    but... why is the new version incompatible with old code? node is one of the biggest programming tools in the world, they wouldn't just create a new version of nodejs that wasn't backwards compatible (i guess they would because they did but you get my point)
    – a1cd
    Oct 31, 2021 at 19:25
  • 15
    Always use LTS for real applications, it fixed the issue. Nov 20, 2021 at 5:42
  • 4
    Is the new LTS after 16 supposed to revert back to old SSL? I am assuming the problem will be the same, just deferred until later, and using LTS 16 is a temporary solution.
    – trusktr
    Dec 21, 2021 at 4:24
  • 61
    From today Node 18.12.0 is LTS, so I think a downgrade is not a valid strategy anymore :-(
    – Arek
    Oct 26, 2022 at 12:17
  • 8
    So if Node v18 is now LTS, what's the solution now? Dec 12, 2022 at 15:01
158

This is the simplest answer and works.

If you're using react-scripts you can now simply upgrade to version 5.0.0 (or above) which seems to have addressed this issue (it includes a newer version of webpack).

Example: npm i react-scripts@latest

10
  • 6
    This fixed the issue for my CI build without going backward on versioning or security (ie increasing tech debt with a loose end in the build). Probably should be the best answer in late 2022. Nov 1, 2022 at 17:31
  • 7
    I agree this should definitely be the accepted answer! I spent a bunch of time trying to make a webpack.config.js with the output hashFunction etc, and then undoing that and trying to do a config-overrides.js file and react-app-rewired since my environment is in docker: ALL A WASTE OF TIME. Seriously. Simply do like @neo said above and update react-scripts. Ex. npm i react-scripts@latest Jan 4, 2023 at 23:42
  • Not working for me when I run storybook
    – Caeta
    Jan 8, 2023 at 0:32
  • 2
    This didn't update the webpack version. I still get the same error after updating react-scripts to the latest version.
    – tRuEsAtM
    Feb 24, 2023 at 18:21
  • 4
    For those who uses yarn: yarn add react-scripts. You might get a core-js error afterwards, then you should run: yarn add core-js Apr 4, 2023 at 7:35
95

I had this issue when using Vue.js.

A disadvantage of using -openssl-legacy-provider is that it is not supported by older Node.js versions. Older Node.js versions simply don't run when this flag is provided.
But I still want to be compatible with Node.js v16 and older.

Vue.js uses the MD4 algorithm to generate hashes (well, actually it's Webpack under the hood). MD4 can be easily replaced by MD5 for these kind of purposes. The type of algorithm used is hard coded in most places, so there isn't any way to configure another algorithm.

So I came up with another workaround. A function that intercepts the original createHash() call from the crypto module and replaces it with a modified version. This is at the start of my vue.config.js file:

const crypto = require('crypto');

/**
 * The MD4 algorithm is not available anymore in Node.js 17+ (because of library SSL 3).
 * In that case, silently replace MD4 by the MD5 algorithm.
 */
try {
  crypto.createHash('md4');
} catch (e) {
  console.warn('Crypto "MD4" is not supported anymore by this Node.js version');
  const origCreateHash = crypto.createHash;
  crypto.createHash = (alg, opts) => {
    return origCreateHash(alg === 'md4' ? 'md5' : alg, opts);
  };
}
9
  • This almost worked for me, but then some part of my webpack build will use some multi-process node build step. Then you won't be able to inject this "shim" into the spawned node instances. I ended up just resolving this at the OpenSSL level: stackoverflow.com/a/73904032/809572 Sep 30, 2022 at 4:48
  • 8
    This is the most elegant solution which also solves the use of md4 and uses md5. (see comment of @JoshBowden linking to stackoverflow.com/a/73904032/16805 which describes underlying issue.)
    – youri
    Oct 21, 2022 at 17:12
  • This was the only thing that solved my problem. Ialso have a Vue project. Thank you!
    – Lucas
    Feb 3, 2023 at 11:37
  • 7
    @Lucas it works because crypto is a singleton. Every time a program (in the same NodeJS runtime) calls require("crypto") the exact same object is returned. Feb 9, 2023 at 13:40
  • 7
    This is the best answer : it does not disable security feature and does not need to go back to Node 16. It just properly overwrite the outdated algo. Thanks.
    – vdechef
    Feb 13, 2023 at 7:45
88

There are a lot of workarounds posted (mostly downgrading Node.js, OpenSSL, or allowing insecure hashing), but the underlying problem is that Webpack's output.hashFunction defaults to md4, which triggers this error in recent versions of OpenSSL.

From Webpack's output.hashFunction docs:

Since Webpack v5.54.0+, hashFunction supports xxhash64 as a faster algorithm, which will be used as default when experiments.futureDefaults is enabled.

The solution is either:

  1. Set output.hashFunction = 'xxhash64'
  2. Set experiments.futureDefaults = true

in your Webpack configuration.

If you're on an older version of Webpack, (prior to v5.54.0) follow the output.hashFunction link above to see what other hashing algorithms are available to you.

10
  • 6
    If like myself, you made this change and you were still hitting issues, then check your loaders. file-loader and css-loader use md4 by default. You can force them to use another hashing algo when setting the name option like so: '[name].[sha512:hash:6].[ext]' Nov 16, 2022 at 10:00
  • Hi @Greg , thanks for this real answer to the problem. But I'm using Nuxt 2 which use Webpack 4 and output doesn't seems to be a rules property. So I'm at a lost on how I can fix this to be able to upgrade the Node version (build on Docker). Any idea? Thx!
    – Claire
    Dec 7, 2022 at 9:52
  • 4
    I am getting a "Error: Digest method not supported" error when setting output.hashFunction to xxhash64. Perhaps because I am using Webpack v4? Dec 12, 2022 at 15:11
  • 6
    I'm sorry but this answer just does not work at all...When you change experiments.futureDeafults to true - webpack throws the error: "experiments is an invalid configuration object, and when setting output hashFunction to xxhash64, you get the error which Paul Razvan Berg mentions above - This answer needs to either be explained further or removed entirely - it caused me more problems than it solved. Dec 19, 2022 at 11:49
  • FYI @Claire, Nuxt3 is out and stable (haven't used it yet): nuxt.com/v3 Jan 11, 2023 at 16:10
85

Update April 2023:

This answer was first posted in December 2021, it has been over a year so this answer might not as reliable or relevant anymore. See other answers about more causes behind this problem and the most updated solution.

Some top answers did not work.

export NODE_OPTIONS=--openssl-legacy-provider

And some top answers were not applicable, modifying package.json file:

"start": "react-scripts --openssl-legacy-provider start"

This is caused by the latest node.js V17 compatible issues with OpenSSL, see this and this issue on GitHub.

The easiest thing is just downgrade from node.js V17 to node.js V16. See this post on how to downgrade node.js.

5
  • 14
    Confirming that downgrading version to V.16 fixed the issue. nvm install v16 && nvm alias default v16 && nvm use v16 . Dec 16, 2021 at 17:15
  • 2
    Downgrading from v17 to v16 fixes the issue
    – onmyway133
    Jan 7, 2022 at 9:52
  • 2
    Yes this solution works perfectly. I've V17 in my workstation and facing this issue. Whereas the same package.json in my GitHub action uses V16 and this error is not happening. Thanks! Jan 17, 2022 at 19:18
  • 10
    downgrading isn't a good option
    – Dan D.
    Oct 28, 2022 at 8:44
  • well, If I add this option, my React code doesn't compile. I get below error ..........Failed to compile ./node_modules/react-idle-timer/dist/index.esm.js SyntaxError: /Users/abdc/thank-you-cards-new/node_modules/react-idle-timer/dist/index.esm.js: Missing class properties transform.
    – Dev
    Nov 29, 2023 at 4:56
85

For macOS, Windows and Linux

After updating to Node.js version 18.17.1, I got into this issue running on my local host, and I was able to resolve it by updating my start command in the package.json file.

Please find the appropriate command below.

"start": "export NODE_OPTIONS=--openssl-legacy-provider && react-scripts start"

You can also use npm audit fix --force. This will also fix it, but somehow it didn't work for me.

3
  • 14
    Windows users can use set instead of export, e.g: "start": "set NODE_OPTIONS=--openssl-legacy-provider && react-scripts start"
    – danwellman
    Aug 29, 2023 at 9:12
  • npm audit fix --force This worked for me. Thanks...!
    – Vikas Hire
    Dec 8, 2023 at 6:21
  • I also added that to the build part "build": "export NODE_OPTIONS=--openssl-legacy-provider && react-scripts build",
    – saba
    Dec 8, 2023 at 15:03
80

I found the commands below on GitHub:

For Windows, use the below command in cmd:

set NODE_OPTIONS=--openssl-legacy-provider

For Unix, use:

export NODE_OPTIONS=--openssl-legacy-provider
8
60

It's the Node.js version.

I have this error on Node.js 17, but it's fine when I switch my Node.js version to an older version (16) by using nvm.

7
  • 13
    Same here. Reverting to node 16 resolved the issue.
    – sam
    Nov 5, 2021 at 15:25
  • 2
    Yup. encountered when trying to run hardhat tests just now. would love to hear a breakdown of what's causing it.
    – Kyle Baker
    Nov 24, 2021 at 19:36
  • 1
    You were right, rolling the npm version back to 16.13.x worked! Dec 5, 2021 at 6:38
  • 4
    If you're using the package manager Chocolatey, you can just choco uninstall nodejs and choco install nodejs-lts to install the LTS version of node.
    – Matthias T
    Dec 16, 2021 at 12:10
  • 2
    Somehow, this error also happens to me on node v16...
    – Yarycka
    Jan 5, 2022 at 8:59
47

For Vue.js related

  1. Enable the legacy OpenSSL provider.

    On Unix-like systems (Linux, macOS, Git Bash, etc.):

    export NODE_OPTIONS=--openssl-legacy-provider
    

    On the Windows command prompt:

    set NODE_OPTIONS=--openssl-legacy-provider
    

    On PowerShell:

    $env:NODE_OPTIONS = "--openssl-legacy-provider"
    
  2. In package.json

    Reconfigure this script for npm run serve as below;

    "scripts": {
        "serve": "vue-cli-service serve --openssl-legacy-provider",
     },
    
38

Failed to construct transformer: Error: error:0308010C:digital envelope routines::unsupported

The simplest and easiest solution to solve the above error is to downgrade Node.js to v14.18.1. And then just delete folder node_modules and try to rebuild your project and your error must be solved.

6
  • this is weirdly worded :| try using the ` character around code markdown help
    – a1cd
    Oct 24, 2021 at 15:27
  • 11
    Version v16.13.0 instead of 17.x worked as well for me. I also didn't need to delete the node_modules folder.
    – Tigerware
    Oct 28, 2021 at 6:51
  • I'm running node version 14.17.3 and I'm still having this issue.
    – brohjoe
    Mar 23, 2022 at 23:01
  • Sep 22: All github actions are run with Node 16: github.blog/changelog/…
    – Dazzle
    Feb 20, 2023 at 20:32
  • Downgrading to Node 14 resolved the issue for me.
    – Khasky
    Jul 5, 2023 at 21:22
38

Temporary solution below. Actual solution is upgrading to Webpack 5.

Updated december 2022

This worked for me (downgrading to Node.js 16):

nvm install 16 --lts
nvm use 16

Using Node.js Version Manager (for Windows).

7
  • It worked for me but I had to do nvm install lts without the dashes (Windows 10 - Powershell). Dec 10, 2021 at 9:28
  • It worked for me, but on my machine nvm install --lts already uses the version it installs, so no need to execute nvm use
    – Tomás
    Feb 18, 2022 at 23:26
  • 12
    This would no longer work as LTS is now 18 Oct 30, 2022 at 0:32
  • need to use like nvm install 16.15.0 or whatever version you want. then nvm use 16.15.0
    – Ted
    Nov 28, 2022 at 15:28
  • Consider the warnings in this - stackoverflow.com/a/73027407/1459653 - answer before doing this. Jan 11, 2023 at 18:39
38

I had the same error.

My case:

I installed a fresh React TypeScript application, added some SCSS content and some components.

Locally, my build was working, but when I tried to publish, it was failing with an error:

Error: error:0308010C:digital envelope routines::unsupported

I fixed this issue by updating my React script library to 5.0.1:

"react-scripts": "^5.0.1",
3
  • wawww 2 weeks of work, after unistall npm and update to the current one, actually was like from one problem to another fixing that pop up another again but finally when I update the local frontend, backend's nodejs and npm so does my laptop system nodejs. I change my react-scripts to latest version.it works Dec 25, 2022 at 20:09
  • I've just run yarn add react-scripts. Feb 20, 2023 at 11:11
  • I have gone through all the answers but this one seemed more relevant as I am using current Node LTS v 18. Instead of downgrading Node version or using legacy SSL provider, using the latest react-script library fixed my problem.
    – Anit
    Mar 2, 2023 at 15:00
33

To bypass the error (in a development environment) you can simply run

export NODE_OPTIONS=--openssl-legacy-provider

before launching your Node.js application.

27

For Angular apps:

You can also edit the npm start script in package.json. Instead of

"start": "ng serve -o"

to

"start": "set NODE_OPTIONS=--openssl-legacy-provider && ng serve -o"

When you run npm run start in the terminal/command line, it will first set the NODE_OPTIONS to avoid the problem.

3
  • 2
    This was the solution for me to run an Angular 9 app with Node v18.14.0.
    – Brugner
    Mar 11, 2023 at 22:16
  • I had pulled down an Angular 12 sample from github and ran into the error. I have Node v18.17.0. This solution worked perfectly for me. Sep 1, 2023 at 4:49
  • This solution worked perfectly for me, running a code base using Angular version 11 with my environment using version 20.11.1
    – DoubleAsam
    Mar 24 at 20:33
25

Windows

  1. Install nvm-windows.

  2. Install the Node.js version that you want.

    nvm install 16
    
  3. Change your Node.js version

    nvm use 16
    
  4. Check the Node.js versions installed

    nvm list
    

macOS

Just setting NODE_OPTIONS then restart again:

export NODE_OPTIONS=--openssl-legacy-provider
1
20

This is a common error when packages on a project are not updated and the React version that you use is not the latest.

To fix this problem, you need to change your package.json file this way:

Change this 👇

"scripts": {
    "start": "react-scripts start",
    "build": "react-scripts build",
    "test": "react-scripts test",
    "eject": "react-scripts eject"
}

to this 👇

"scripts": {
    "start": "react-scripts --openssl-legacy-provider start",
    "build": "react-scripts --openssl-legacy-provider build",
    "test": "react-scripts test",
    "eject": "react-scripts eject"
}
1
  • this has already been posted, also it's only appropriate for dev env
    – Ed_
    Jan 5, 2023 at 4:30
20

I had the same problem, and the following worked.

Set the NODE_OPTIONS environment variable to --openssl-legacy-provider. To do this, open your terminal and run the below command:

For macOS, Linux or Windows Git Bash

export NODE_OPTIONS=--openssl-legacy-provider
1
  • 1
    This is working
    – Fantasyczl
    Nov 30, 2023 at 5:16
18

I faced this issue in Docker build, and I have added this line in the Docker file:

RUN export NODE_OPTIONS=--openssl-legacy-provider && yarn build && yarn install --production --ignore-scripts --prefer-offline

For local development, add the switch in file package.json.

3
  • NODE_OPTIONS=--openssl-legacy-provider is command line argument which should be present when you run yarn build. Nothing to do with Docker. When you build docker image of your application above line is what you use to build Nov 2, 2021 at 12:42
  • This is a near-duplicate of Ajoy Karmakar's answer. This one is also missing an explanation. Can you please provide an explanation? E.g., why is --openssl-legacy-provider necessary? Why all the yarn stuff? Please respond by editing (changing) your answer, not here in comments (without "Edit:", "Update:", or similar - the answer should appear as if it was written today). Jan 2, 2022 at 2:31
  • The answer above runs in docker file with yarn as package manager. This will help users who are using similar environments and unable to resolve with other answers provided. Ill edit the answer with more explanation. Thanks Jan 4, 2022 at 15:10
18

Running audit fixed the problem for me

npm audit fix --force
2
  • The uncomfortable path, but the right path. I had to run the audit fix more than once until it completed most fixes. Just minor code brakes. Worth it Apr 4, 2023 at 13:32
  • Solved my case on the first try! Thanks for keeping my system secure!.
    – Blind2k
    Jun 13, 2023 at 19:48
17

As a 2022 reader, none of the answers address the fact that this issue was fixed early on for Webpack 5 users (but not backported to Webpack 4). If you're on Webpack 5, simply upgrade to at least 5.61.0. See this comment here on the thread tracking this issue.

5
  • npm install webpack@latest Nov 9, 2022 at 6:58
  • 2
    Thank you! This answer helped me solve the issue in a reasonable way. It is like the 22nd answer on the page but it is by far the most reasonable. The error is happening inside of webpack. So it makes sense to update webpack. I updated to the latest version of webpack and now I no longer see this error. The other answers are basically 1. hide the error message 2. upgrade all dependencies or 3. downgrade your dependencies. To be fair, those answers will make the error message go away. But they aren't the best answers.
    – Kevin
    May 31, 2023 at 18:09
  • @Kevin It blew my mind how hard it was to find that Webpack straight up fixed the issue and you just have to update to get the fix. I was too stubborn to go with any of these hacks. Jun 29, 2023 at 22:47
  • I updated webpack to 5.8.0 but issue is still the same...
    – John
    Sep 18, 2023 at 15:23
  • 1
    @John 5.8.0 is not higher than 5.61.0. 5.80.0 is. Sep 26, 2023 at 12:15
14

If you are facing this error and you do not want to change your main configuration, an easy fix would be to use the following approach. I am not sure if it is recommended as a good practice, though.

Feel free to correct it.

Initially, let’s say this is the scripts section of my package.json file:

...
"version": "1.0.0",
  "scripts": {
    ...
    "build": "npm run build:test-app:testing",
    "build:test-app:testing": "ng build test-app --deploy-url  https://test-app.com/ --configuration=test-config",
    ...
  },
  "private": true,
...

In order to use this export NODE_OPTIONS=--openssl-legacy-provider you can do the following:

"version": "1.0.0",
  "scripts": {
....
    "build": "NODE_OPTIONS=--openssl-legacy-provider npm run build:test-app:testing”,
    "build:test-app:testing": "NODE_OPTIONS=--openssl-legacy-provider ng build test-app --deploy-url  https://test-app.com/ --configuration=test-config"
...
  },
  "private": true,

Take note of the build scripts. I have added an option: NODE_OPTIONS=--openssl-legacy-provider

This helps solve this error in Node.js version 17.

For those with the flexibility of changing the build system's Node.js version, just switch to a version lower that 17, e.g., version 16.

For Docker, the use case of using this initially, which always pulls the latest version:

...
FROM node:alpine
...

You can switch to something like:

...
FROM node:16-alpine3.12
...
0
14

Same Error with node version v18.0.0 and nuxt framework version 2.15 when running dev server and will be fixed by:

"scripts": {
  "dev": "NODE_OPTIONS=--openssl-legacy-provider nuxt"
}
1
  • Got error: Cannot find module
    – MAZ
    Feb 28, 2023 at 22:30
14

check

node -v
v17.4.0

then roll back to node --lts (node v16.13.2 (npm v8.1.2)) for that use nvm.

nvm install 16

then check node -v and confirm it's version 16.

4
  • 5
    I'm using v16.13.2 and I've this error
    – titusfx
    Feb 19, 2022 at 18:38
  • This worked for me, also I did update react scripts first so one of them fixed the issue.
    – Shazam
    Jun 1, 2022 at 16:24
  • Remember that your answer will outlive what lts means. Right now it's v16, a year from now it's going to be v18, so if you're telling folks they need v16, give the nvm instructions for that version, not "whatever lts happens to be". Sep 4, 2022 at 17:08
  • Consider the warnings in this - stackoverflow.com/a/73027407/1459653 - answer before doing this. Jan 11, 2023 at 18:43
12

This solution worked for me.

This error is coming in Node.js version 17+, so try to downgrade the Node.js version.

  1. Uninstall Node.js from the computer.
  2. Download Node.js version 16 and install it again from https://nodejs.org/download/release/v16.13.0/

That's all.

5
  • 6
    but why? Why did node v17 have problems
    – a1cd
    Nov 11, 2021 at 20:56
  • 3
    @Evergreen This is most likely a webpack4 issue, also in version 17 Node.js developers have deprecated of trailing slash pattern mappings which is unsupported in the import maps specification. Node.js developers needs to resolve this asap. Nov 12, 2021 at 8:21
  • 1
    yea, i would expect node js, being such a widely used product, would have a bit more care put into backwards compatibility.
    – a1cd
    Nov 13, 2021 at 16:02
  • 1
    or, if you're using nvm (node version manager) (and if you're not, you should be, so take this moment to do so...), you can just type nvm install 16 and you're good to go.
    – Kyle Baker
    Nov 24, 2021 at 19:38
  • note that the phrasing is misleading: the "error" is not an error at all, it's Node 17+ actually using an secure, rather than known insecure, version of OpenSSL. The bypass is to install Node 16 and keep running with insecure SSL behaviour, but the solution is to update your dependencies to ones that are Node 17+ compatible. Sep 4, 2022 at 17:05
12

This answer is an immediate OpenSSL system-level workaround without touching a previously working build configuration.

In the ideal world, you have time to upgrade and migrate insecure build dependencies and make sure you didn't break something else in your application (or wholesale just avoid webpack, or in my case migrate from vue-cli to vite which uses esbuild).

You "should" instead either, (a) tell webpack to use a newer hash function, or (b) mitigate the offending packages with npm audit.


System-level OpenSSL workaround

The quickest workaround is to temporarily re-enable MD4 by enabling the "legacy" crypto providers within the system-wide OpenSSL configuration.

This is incredibly insecure and heavy-handed. Afterwards, you should disable the legacy crypto methods.

(Unfortunately, the following is only tested to work on Linux).

  1. Backup your existing OpenSSL configuration: sudo cp /etc/ssl/openssl.cnf /etc/ssl/openssl.cnf.BAK

  2. Append (or uncomment) the following configuration to enable the legacy "providers" (as OpenSSL calls them). You probably want to sudo vim /etc/ssl/openssl.cnf or similar.

    [provider_sect]
    default = default_sect
    legacy = legacy_sect
    
    [default_sect]
    activate = 1
    
    [legacy_sect]
    activate = 1
    
  3. Rerun your node script as before.

  4. Disable the legacy providers afterwards.

    sudo mv -f /etc/ssl/openssl.cnf.BAK /etc/ssl/openssl.cnf

This solution is from an answer to a similar problem.


What is the underlying cause?

Node uses OpenSSL for its hash functions and encryption on *nix systems. The latest version of OpenSSL disables MD4 by default—which will break any previously working program that uses MD4. With that in mind, any npm package that thought using MD4 for file hashes was a "good idea" are now broken—even though MD4 has been considered broken by RSA Labs since 1996! MD4 was also "officially" relegated as obsolete by RFC 6150 in 2011.

11

You have to use MD5 in this file. MD4 is the default, but it will not work. It will work without an issue, until you delete the node_modules folder folder.

Go to this path: */node_modules/metro-cache/src/

Change the file stableHash.js like below from md4 to md5:

Enter image description here

5
  • Thank you Hitesh your solution saved me
    – M.skr
    Jun 16, 2023 at 21:23
  • This must have many votes. this is the answer finally helped me. btw @hitesh will there be fixes in future from RN
    – Im Batman
    Jul 11, 2023 at 18:02
  • 1
    You're my hero!! From all answers this solution worked :)
    – Lucdabomb
    Jul 31, 2023 at 8:57
  • Tis worked for me. Is it not possible to fix this by updating a relevant package though?
    – MomasVII
    Aug 18, 2023 at 7:37
  • How is this a solution? You are editing a node module which will be replaced on the next install. Mar 25 at 12:19
7

In PowerShell:

$env:NODE_OPTIONS = "--openssl-legacy-provider"

It worked with Node.js v18.7.0.

1

Not the answer you're looking for? Browse other questions tagged or ask your own question.