error:0308010C digital envelope routines::unsupported: cause and fix

Short answer: the bundler asked OpenSSL 3 for an algorithm, md4, that OpenSSL 3 no longer exposes in the default provider. This is not a bug in your code and you cannot fix it in the code: you fix it by updating the tool that computes the hashes, or by telling Node to re-enable the legacy provider.

The exact message

Error: error:0308010C:digital envelope routines::unsupported
    at new Hash (node:internal/crypto/hash:79:19)
  opensslErrorStack: [ 'error:03000086:digital envelope routines::initialization error' ],
  library: 'digital envelope routines',
  reason: 'unsupported',
  code: 'ERR_OSSL_EVP_UNSUPPORTED'

The 0308010C prefix is the OpenSSL code: it says the requested algorithm is not available under the current provider settings. The rest of the stack shows where Node tried to create the hash.

Why it happens

Node 17 moved to OpenSSL 3. Webpack 4, and the tools that wrap it such as create-react-app 4, vue-cli 4 and some Next 11 setups, uses md4 to compute chunk identifiers. OpenSSL 3 keeps md4 in the legacy provider, off by default because it counts as weak.

Hence the paradox: the project is not ten years old, yet one build step depends on an algorithm the operating system no longer considers safe.

Quick fix, as a stopgap

# macOS / Linux
NODE_OPTIONS=--openssl-legacy-provider npm run build

# PowerShell
$env:NODE_OPTIONS = "--openssl-legacy-provider"
npm run build

The flag re-enables the legacy provider for the whole Node process. It works at once and is fine for unblocking a local build. Do not leave it in the production pipeline: it re-enables weak algorithms for code that never asked for them.

The lasting fix

1. Update the bundler to webpack 5, or move to Vite or rspack.
2. On create-react-app, take react-scripts to 5 or migrate to Vite: version 4 will get no further fixes.
3. If a dependency pins the bundler, isolate that dependency: the problem is its own, not the whole project's.

npm ls webpack
npx webpack --version

The first command shows who pulls webpack into the dependency tree; the second shows the version actually in use. A version 4 answer means the legacy flag is a symptom, not the cure.

When the fix does not work

If the error survives with NODE_OPTIONS set, the failing process never inherited the environment. That happens with scripts that spawn a second Node, with containers that drop variables, or with a command that runs a separate worker. Check with node -p process.env.NODE_OPTIONS inside the script that fails: an empty line means the variable did not arrive.

How to prevent it

• Pin the Node major in .nvmrc and in engines in package.json.
• Build in CI with the same major you use locally: the gap between the two is the most common cause.
• Treat every use of --openssl-legacy-provider as technical debt with an expiry date.

Where to continue

The EneUI catalogue holds 111,985 components and 1,556 blocks with previews: the records are already compiled, so they never force you to patch a legacy toolchain. To see which library costs least at build time read how much a UI library weighs; for project structure, App Router in 2026; for the comparison of alternatives to MUI. The ranking of measured catalogues is at /best/ui-catalogues.