474

I'm having an issue with a Webpack build process that suddenly broke, resulting in the following error...

<s> [webpack.Progress] 10% building 0/1 entries 0/0 dependencies 0/0 modules
node:internal/crypto/hash:67
  this[kHandle] = new _Hash(algorithm, xofLen);
                  ^

Error: error:0308010C:digital envelope routines::unsupported
    at new Hash (node:internal/crypto/hash:67:19)
    at Object.createHash (node:crypto:130:10)
    at BulkUpdateDecorator.hashFactory (/app/node_modules/webpack/lib/util/createHash.js:155:18)
    at BulkUpdateDecorator.update (/app/node_modules/webpack/lib/util/createHash.js:46:50)
    at OriginalSource.updateHash (/app/node_modules/webpack-sources/lib/OriginalSource.js:131:8)
    at NormalModule._initBuildHash (/app/node_modules/webpack/lib/NormalModule.js:888:17)
    at handleParseResult (/app/node_modules/webpack/lib/NormalModule.js:954:10)
    at /app/node_modules/webpack/lib/NormalModule.js:1048:4
    at processResult (/app/node_modules/webpack/lib/NormalModule.js:763:11)
    at /app/node_modules/webpack/lib/NormalModule.js:827:5 {
  opensslErrorStack: [ 'error:03000086:digital envelope routines::initialization error' ],
  library: 'digital envelope routines',
  reason: 'unsupported',
  code: 'ERR_OSSL_EVP_UNSUPPORTED'
}
command terminated with exit code 1

I've tried googling ERR_OSSL_EVP_UNSUPPORTED webpack which yielded almost no useful results, but it did highlight an issue using MD4 as provided by OpenSSL (which is apparently deprecated?) to generate hashes.

The webpack.config.js code is as follows:

const path = require('path');
const webpack = require('webpack');

/*
 * SplitChunksPlugin is enabled by default and replaced
 * deprecated CommonsChunkPlugin. It automatically identifies modules which
 * should be splitted of chunk by heuristics using module duplication count and
 * module category (i. e. node_modules). And splits the chunks…
 *
 * It is safe to remove "splitChunks" from the generated configuration
 * and was added as an educational example.
 *
 * https://webpack.js.org/plugins/split-chunks-plugin/
 *
 */

/*
 * We've enabled TerserPlugin for you! This minifies your app
 * in order to load faster and run less javascript.
 *
 * https://github.com/webpack-contrib/terser-webpack-plugin
 *
 */

const TerserPlugin = require('terser-webpack-plugin');

module.exports = {
    mode: 'development',
    entry: './src/js/scripts.js',

    output: {
        path: path.resolve(__dirname, 'js'),
        filename: 'scripts.js'
    },

    devtool: 'source-map',

    plugins: [new webpack.ProgressPlugin()],

    module: {
        rules: []
    },

    optimization: {
        minimizer: [new TerserPlugin()],

        splitChunks: {
            cacheGroups: {
                vendors: {
                    priority: -10,
                    test: /[\\/]node_modules[\\/]/
                }
            },

            chunks: 'async',
            minChunks: 1,
            minSize: 30000,
            name: 'true'
        }
    }
};

How do I change the hashing algorithm used by Webpack to something else?

3

12 Answers 12

687

I was able to fix it via:

export NODE_OPTIONS=--openssl-legacy-provider

sachaw's comment to Node.js v17.0.0 - Error starting project in development mode #30078

But they say they fixed it: ijjk's comment to Node.js v17.0.0 - Error starting project in development mode #30078:

Hi, this has been updated in v11.1.3-canary.89 of Next.js, please update and give it a try!

For me, it worked only with the annotation above.

I also want to point out that npm run start works with -openssl-legacy-provider, but npm run dev won't.

It seems that there is a patch: Node.js 17: digital envelope routines::unsupported #14532

I personally downgraded to 16-alpine.

17
  • 78
    PowerShell: $env:NODE_OPTIONS="--openssl-legacy-provider"
    – Hex
    Jan 10, 2022 at 12:22
  • 9
    before you run your server: "scripts": { "debug": "NODE_OPTIONS='--openssl-legacy-provider' next dev -p 5000"
    – Jan
    Jan 30, 2022 at 0:31
  • 16
    You can run all at once: NODE_OPTIONS=--openssl-legacy-provider npm start
    – Seralto
    Feb 10, 2022 at 12:59
  • 9
    Doesn't work with node v16.14.0 for me on Fedora 36: node: --openssl-legacy-provider is not allowed in NODE_OPTIONS Jun 1, 2022 at 8:43
  • 3
    On windows with react, edit package.json json { "scripts": { "start": "set \"NODE_OPTIONS=--openssl-legacy-provider\" && react-scripts start"}}
    – pushStack
    May 1 at 12:05
183

I had this problem too. I'd accidentally been running on the latest Node.js (17.0 at time of writing), not the LTS version (14.18) which I'd meant to install. Downgrading my Node.js install to the LTS version fixed the problem for me.

12
  • 22
    Same here. Downgrading to 16.x worked as well. Its LTS start in a week (2021-10-26) according to nodejs.org/en/about/releases so I went for that.
    – Gustav
    Oct 20, 2021 at 7:33
  • 3
    I am having this problem with v16.13.0.
    – Trip
    Nov 11, 2021 at 22:35
  • 6
    Confirm downgrade from v17.2.0 to v16.13.1 is working fine
    – Mauzzz0
    Jan 17, 2022 at 10:47
  • 4
    Thanks. Node Version Manager via nvm or nvm-windows works excellent for switching effortlessly between versions
    – tno2007
    Jun 28, 2022 at 10:39
  • 1
    Before following suggestions that open your app to security vulnerabilities, please see answer to same question here: stackoverflow.com/a/73027407/1072629 In the best world scenario, find the right fix for the issue instead of hacking in a solution. It may work, but that doesnt mean it is right Mar 23 at 12:36
76

It is not my answer really, but I found this workaround /hack/ to fix my problem Code Check in for a GitHub project... see the bug comments here.

I ran into ERR_OSSL_EVP_UNSUPPORTED after updating with npm install.

I added the following to node_modules\react-scripts\config\webpack.config.js

const crypto = require("crypto");
const crypto_orig_createHash = crypto.createHash;
crypto.createHash = algorithm => crypto_orig_createHash(algorithm == "md4" ? "sha256" : algorithm);

I tried Ryan Brownell's solution and ended up with a different error, but this worked...


Typescript equivalent:

import crypto from "crypto";

const crypto_orig_createHash = crypto.createHash;
Object.assign(crypto, {
  createHash: (algorithm: string): crypto.Hash => crypto_orig_createHash(algorithm === "md4" ? "sha256" : algorithm),
});
6
  • 1
    This worked fine for me in Webpack4. I'm bouncing between 12LTS / 17 and this is a big time saver. Oct 23, 2021 at 23:34
  • 2
    This should be the accepted answer in 2021. Thank you for describing the folder location of the file as well. It solved my issue. I had previously tried the solution that exports variables to the environment and it caused VSCode to no longer load. So this solves it without globally compromising other programs.
    – Terry
    Nov 5, 2021 at 15:57
  • So we have to add the code when react-scripts - now 3.0.1 or 3.4.4 - gets a newer Version?
    – Timo
    Jan 9 at 13:00
  • It's also working in the app's own config/webpack.config.js file, so great solution! Feb 21 at 8:20
  • Finally a solution that actually works, doesn't leave us vulnerable, and doesn't assume a specific project setup (this can go in the main projects config file). Thank you! Aug 30 at 13:24
66

Ryan Brownell's answer is the ideal solution if you are using Webpack v5.54.0+.

If you're using an older version of Webpack, you can still solve this by changing the hash function to one that is not deprecated. (It defaults to the ancient md4, which OpenSSL has removed support for, which is the root cause of the error.) The supported algorithms are any supported by crypto.createHash. For example, to use SHA-256:

module.exports = {
    output: {
        hashFunction: "sha256"
    }
};

Finally, if you are unable to change the Webpack configuration (e.g., if it's a transitive dependency which is running Webpack), you can enable OpenSSL's legacy provider to temporarily enable MD4 during the Webpack build. This is a last resort. Create a file openssl.cnf with this content…

openssl_conf = openssl_init

[openssl_init]
providers = provider_sect

[provider_sect]
default = default_sect
legacy = legacy_sect

[default_sect]
activate = 1

[legacy_sect]
activate = 1

…and then set the environment variable OPENSSL_CONF to the path to that file when running Webpack.

1
  • 10
    Turns out that the hashFunction fix can help. but it might be insufficient: the ConcatenatedModule optimizer in Webpack 4.x hardcodes the use of MD4, so if your build process uses it, you might need to go the openssl.cnf route. I think this might be the general case for Vue CLI 4.x projects.
    – Peter
    Oct 21, 2021 at 15:23
62

There is a hashing algorithm that comes with Webpack v5.54.0+ that does not rely on OpenSSL.

To use this hash function that relies on a npm-provided dependency instead of an operating system-provided dependency, modify the webpack.config.cjs output key to include the hashFunction: "xxhash64" option.

module.exports = {
    output: {
        hashFunction: "xxhash64"
    }
};
5
  • 26
    I'm getting Error: Digest method not supported
    – Jack
    Feb 20, 2022 at 4:26
  • 4
    agree. webpack upgrade fixed the issue for me. I was using react 17, then upgraded to react 18 which did bring me webpack 5.74.0 => problem solved.
    – tswaehn
    Jul 25, 2022 at 10:39
  • 2
    If you still get this error on webpack 5.54+ and node 17+, look at your stack trace. In my case, babel-loader: 8.2.2 was also using a deprecated hashing function. Upgrading to babel-loader: 8.3.0 fixed the issue.
    – bendytree
    Jan 24 at 17:18
  • I had the same scenario as @bendytree. Turns out I didn't even need to use the hashFunction webpack configuration at all. Upgrading to babel-loader: 8.3.0 solved the issue. Looks like it was actually fixed in 8.2.4: github.com/babel/babel-loader/releases/tag/v8.2.4.
    – Eli Dupuis
    Mar 22 at 20:47
  • xxhash64 is also now gone... you can try a different variant of this by switching hashFunction to: "sha256"... but I still had issues in the next layer down (possibly because of harcoded usage of md4).
    – Zargold
    Jul 28 at 16:14
26

This error is mentioned in the release notes for Node.js 17.0.0, with a suggested workaround:

If you hit an ERR_OSSL_EVP_UNSUPPORTED error in your application with Node.js 17, it’s likely that your application or a module you’re using is attempting to use an algorithm or key size which is no longer allowed by default with OpenSSL 3.0. A command-line option, --openssl-legacy-provider, has been added to revert to the legacy provider as a temporary workaround for these tightened restrictions.

3
  • 3
    I didnt work here. :( --openssl-legacy-provider is not allowed in NODE_OPTIONS
    – Cesarvspr
    Jun 27, 2022 at 16:04
  • 5
    @Cesarvspr you have to add it to the env var, not as an argument to npm command. NODE_OPTIONS='--openssl-legacy-provider' npm run build
    – Cristian
    Nov 3, 2022 at 7:41
  • Thanks, you are right. I figured this out after some research
    – Cesarvspr
    Nov 3, 2022 at 15:29
23

I faced the same challenge, but you just need to downgrade Node.js to version 16.13 and everything works well. Download LTS, not the current on Downloads.

2
  • 1
    This works.. I just used 'n' to update to lts and it started working for me Oct 8, 2022 at 11:03
  • Worked for 16.20.0 LTS for my Angular project. :) Jun 14 at 9:23
22

I ran into this issue using Laravel Mix (Webpack) and was able to fix it within file package.json by adding in the NODE_OPTIONS=--openssl-legacy-provider (referenced in Jan's answer) to the beginning of the script:

package.json:

{
  "private": true,
  "scripts": {
    "production": "cross-env NODE_ENV=production NODE_OPTIONS=--openssl-legacy-provider  node_modules/webpack/bin/webpack.js --progress --hide-modules --config=node_modules/laravel-mix/setup/webpack.config.js"
  },
  "dependencies": {
    ...
  }
}
0
21

Try upgrading your Webpack version to 5.62.2.

3
  • This should be accepted, upgrading WebPack solved the issue for me. Thanks!! Jan 11, 2022 at 1:05
  • 1
    I'm on webpack 5.81.0, still have this issue
    – cdalxndr
    Apr 27 at 15:24
  • This didn't work for me. Updated my webpack to mentioned version but didn't work. Am i missing anything? Oct 19 at 18:15
12

I faced the same problem in a project I developed with Next.js. For the solution, I ran the project as follows and I solved the problem.

cross-env NODE_OPTIONS='--openssl-legacy-provider' next dev
1
  • For those using Vue 2 you can simply add NODE_OPTIONS='--openssl-legacy-provider' don't include cross-env
    – JPilson
    Sep 29, 2022 at 9:30
11

I had the same problem with my Vue.js project and I solved it.

macOS and Linux

  1. You should have installed NVM (Node Version Manager). If you never had before, just run this command in your terminal:

curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.0/install.sh | bash

  1. Open your project

  2. Open the terminal in your project

  3. Run the command nvm install 16.13.0 or any older version

  4. After the installation is completed, run nvm use 16.13.0

3
3

This means that you have the latest Node.js version. If you are using it for Docker then you need to change the image from

FROM node

to

FROM node:14
2
  • 5
    downgrading whole node shouldnt be considered as good practice Feb 8 at 9:11
  • With Node Version Manager (nvm) globally installed try $ nvm use 14
    – Liam Hogan
    May 31 at 23:25

Not the answer you're looking for? Browse other questions tagged or ask your own question.