A

67

2222

I created the default IntelliJ IDEA React project and got this:

Error: error:0308010C:digital envelope routines::unsupported
    at new Hash (node:internal/crypto/hash:67:19)
    at Object.createHash (node:crypto:130:10)
    at module.exports (/Users/user/Programming Documents/WebServer/untitled/node_modules/webpack/lib/util/createHash.js:135:53)
    at NormalModule._initBuildHash (/Users/user/Programming Documents/WebServer/untitled/node_modules/webpack/lib/NormalModule.js:417:16)
    at handleParseError (/Users/user/Programming Documents/WebServer/untitled/node_modules/webpack/lib/NormalModule.js:471:10)
    at /Users/user/Programming Documents/WebServer/untitled/node_modules/webpack/lib/NormalModule.js:503:5
    at /Users/user/Programming Documents/WebServer/untitled/node_modules/webpack/lib/NormalModule.js:358:12
    at /Users/user/Programming Documents/WebServer/untitled/node_modules/loader-runner/lib/LoaderRunner.js:373:3
    at iterateNormalLoaders (/Users/user/Programming Documents/WebServer/untitled/node_modules/loader-runner/lib/LoaderRunner.js:214:10)
    at iterateNormalLoaders (/Users/user/Programming Documents/WebServer/untitled/node_modules/loader-runner/lib/LoaderRunner.js:221:10)
/Users/user/Programming Documents/WebServer/untitled/node_modules/react-scripts/scripts/start.js:19
  throw err;
  ^

It seems to be a recent issue - webpack ran into this 4 days ago and is still working on it.

Aware answered 23/10, 2021 at 23:39 Comment(12)

Do the workarounds mentioned in that issue link work for you? – Fungal 23/10, 2021 at 23:58

@Mike'Pomax'Kamermans There are no workarounds in the issue by Webpack :/ This is why I asked this question. – Aware 25/10, 2021 at 20:19

Yes there are? github.com/webpack/webpack/issues/14532#issuecomment-947012063 was posted 6 days ago (and there's lots of followup since then from people asking exactly how to use that, with lots of explanations by several folks). – Fungal 25/10, 2021 at 21:31

@Mike'Pomax'Kamermans my bad! i saw that and thought 'but where' and looked for an answer but only found people asking what i wanted to know. My bad! – Aware 25/10, 2021 at 22:57

If you have come here with this error on NodeJS v18.x, the cause is the same. See web.archive.org/web/20220412174915/https://nodejs.org/api/… for details as to the cause, and follow the instructions to enable the OpenSSL legacy provider web.archive.org/web/20220416014625/https://nodejs.org/api/… – Grindle 28/4, 2022 at 2:47

Have you tried to update to the latest version of webpack? I'm not sure about the cause of this bug, but it was already fixed on the latest version. – Canonical 11/8, 2022 at 11:45

just run the compatible version with the current project nvm exec [v] [npm run dev] || [node app.js] check nvm -h examples – Parthenogenesis 19/8, 2022 at 6:20

This worked for me: https://mcmap.net/q/45651/-webpack-build-failing-with-err_ossl_evp_unsupported-duplicate – Jurgen 3/1, 2023 at 23:50

I don't want to hijack the comments section, but I think it's crazy that the top 10 answers recommend downgrading your security or sticking to an outdated node version when for most people facing this issue (and the OP) the solution is simply upgrading react-scripts to >5! – Bawl 24/2, 2023 at 17:12

@neopostmodern, sometimes projects can't be easily upgraded, sometimes there are budget or time constraints, etc. Downgrading is, sometimes, the way to go. Not everything is perfect or easy. – Razzledazzle 30/6, 2023 at 15:10

I'm not trying to argue that real-world constrains or setups without react-scripts don't exist, but they can't possibly reflect/justify the current order of answers. I'd expect those to be "In case the obvious solution doesn't work, try these workarounds" kind of answers you get when you scroll down. – Bawl 1/7, 2023 at 16:21

Maybe someone finds this useful, I have been using "webpack": "^5.7.0", and upgraded to "webpack": "^5.88.2", and it worked. I presume the transient dependencies were updated (possibly due to security issues). – Weathertight 19/9, 2023 at 10:19

S

1125

In your package.json: change this line

"start": "react-scripts start"

to

"start": "react-scripts --openssl-legacy-provider start"

Stymie answered 25/10, 2021 at 19:45 Comment(16)

but note that --openssl-legacy-provider means you are now almost certainly running with known insecure SSL, so this might mitigate the symptom, but it probably doesn't fix the underlying problem. – Fungal 25/10, 2021 at 21:29

But of cause, this is acceptable when running localhost. In the newly released VS 2022, starting a react-app from scratch, having VS 2022 creating a self-signed certificate for you, still causes the sample project to crash. This is also an issue when creating a react-project from scratch using NPM commandline "npx create-react-app react-core-test". I testet this in two distinct environments runnin WIndows 10 and Windows 11. – Kamenskuralski 3/12, 2021 at 10:29

See Ashok's answer. It's the correct solution to keep SSL working without vulnerabilities and it worked for me. – Twyla 6/12, 2021 at 19:53

I don't understand the implication that, somehow, using node 16 with openssl 1.x would be more secure than using node 17 with openssl 3 in legacy mode. OpenSSL made something stricter in v3. You're either defeating that restriction one way, or the other. Both approaches are probably equally insecure. – Barina 8/12, 2021 at 16:58

nodejs.org/en/blog/release/v17.0.0 – Cairns 6/1, 2022 at 23:12

This has been solved in react-scripts 5: https://mcmap.net/q/44955/-error-message-quot-error-0308010c-digital-envelope-routines-unsupported-quot – Bawl 3/3, 2022 at 9:11

thanks, adding this parameter worked in my latest node version. I am impressed how node / react related commands keep breaking months after we create a solution and try to maintain it. – Margalit 19/4, 2022 at 19:28

Thanks, I had to modify similarly in my nextjs app "dev": "cross-env NODE_OPTIONS=\"--openssl-legacy-provider\" node server.js", – Rest 3/10, 2022 at 9:43

Thanks! This worked like charm. But this means the project is somewhat insecure. – Diandiana 6/11, 2022 at 23:29

In case anyone found this while working on a React Native project and attempting to build through XCode (likely on an M1 Mac), you can add this node arg in node_modules/react-native/scripts/react-native-xcode.sh. Mine was found at line 103, but of course that may vary based on versions, &c. I just updated the line to read: [ -z "$NODE_ARGS" ] && export NODE_ARGS="--openssl-legacy-provider" and I was instantly back in business. Note that this may well be overwritten after each npm install or yarn run, and would likely be ignored by your version control as it lives in node_modules. – Nucleonics 12/11, 2022 at 6:58

what I need to change in case ReactNative? – Turpin 20/12, 2022 at 11:26

This doesn't work for Webpack. – Mudskipper 21/3, 2023 at 16:45

Worked for me, so hacky or not, this is the goto solution for anyone wanting to try out some react project with this problem. – Craftwork 12/4, 2023 at 18:10

I needed to do a npm audit fix --force first to get this working. – Unalloyed 10/5, 2023 at 13:7

thanks a lot, i use all methods above but none of them works, only working when changing script command – Limicoline 12/2 at 13:7

I was also facing same issue, but i resolve this by performing two steps: 1. npm audit fix --force 2. upgrading my node version from version 18 to 21. I think mostly this error comes in version 18 of node. – Kyleekylen 10/4 at 17:13

V

2695

You can try one of these:

1. Downgrade to Node.js v16.

You can reinstall the current LTS version from Node.js’ website.
You can also use nvm. For Windows, use nvm-windows.

2. Enable legacy OpenSSL provider.

On Unix-like (Linux, macOS, Git bash, etc.):

export NODE_OPTIONS=--openssl-legacy-provider

On Windows command prompt:

set NODE_OPTIONS=--openssl-legacy-provider

On PowerShell:

$env:NODE_OPTIONS = "--openssl-legacy-provider"

Reference

Virgenvirgie answered 24/10, 2021 at 18:44 Comment(60)

where do i put this? – Aware 25/10, 2021 at 20:13

@Evergreen you have to define the variable when you are building --> in your npm run command (you can use export, SET or cross-env depending on your OS) – Alla 28/10, 2021 at 7:23

For me this command fails /usr/local/Cellar/node/17.0.1/bin/node: --openssl-legacy-provider is not allowed in NODE_OPTIONS – Tayyebeb 13/11, 2021 at 4:30

what about docker run --rm -v $(pwd):/usr/src -w="/usr/src" node:latest export NODE_OPTIONS=--openssl-legacy-provider && yarn build /usr/local/bin/docker-entrypoint.sh: 11: exec: export: not found @ajoy-karmakar – Boschbok 14/11, 2021 at 6:12

Worked for me, windows 10 using gitbash terminal (with the unix commands option enabled during installation) – Beaconsfield 15/11, 2021 at 13:37

This solution is not recomended, try to uninstall Node.js version 17+ and reinstall the Node.js version 16+. – Helenehelenka 24/11, 2021 at 8:30

did set NODE_OPTIONS=--openssl-legacy-provider It's giving the same error – Sherlynsherm 25/11, 2021 at 20:57

@AbdulBasitRishi This worked well, thank you for posting. It seems like a very telling solution... is this an issue buried within the newest Node version or is it just incidental that reverting to the older version solves it? – Tristichous 29/11, 2021 at 20:10

Hi, please edit this and add windows command --> set NODE_OPTIONS=--openssl-legacy-provider. Thank you! – Columniation 11/1, 2022 at 13:33

For many using Linux doing a simple export NODE_OPTIONS=--openssl-legacy-provider is not a very efficient solution. Once your terminal session ends that change goes away. If you wanted to make this permanent you'd have to add it to something like ~/.bash_profile or ~/.bashrc. Regardless, as mentioned by others I think setting an environment variable to work around the problem feels a bit hacky. Better to revert to LTS version of node in my opinion. – Centuplicate 29/1, 2022 at 20:19

I've this problem with node 16.13.2 – Yanyanaton 19/2, 2022 at 18:39

Downgrading to 16.13.0 is not enough, and it still won't let you use --openssl-legacy-provider. To use this parameter, you must be on v17 and up, and the parameter must be placed inside your package.json, it won't allow you to just place it in the NODE_OPTIONS env var for security reasons. And then it still doesn't work. This will only become a bigger problem as more people move onto the v16 LTS as a lot of projects still depend on Webpack 4 – Cattalo 27/2, 2022 at 23:21

I'm using nvm, so I just switched versions to: 16 and it worked perfectly. It wasn't required for me to define the SSL env variables. – Suboxide 5/4, 2022 at 19:48

How did you switch versions? – Ironlike 25/4, 2022 at 20:34

Please go through the answer again. I have updated the answer. – Virgenvirgie 26/4, 2022 at 7:27

If you use multiple versions of node, it's best to use nvm and uninstall node all together. Then use node version manager to install the latest version using nvm install lts && nvm use lts – Sadick 26/5, 2022 at 2:2

On PowerShell, $env:NODE_OPTIONS = "--openssl-legacy-provider". Upgrading to 18.4.0 didn't help. – Corie 18/6, 2022 at 1:14

On Mac Monterrey, this env. variable mentioned in the answer solved it: export NODE_OPTIONS=--openssl-legacy-provider – Attenuant 21/6, 2022 at 8:10

The answer by @rob-juurlink was the only one which was feasible for me https://mcmap.net/q/44955/-error-message-quot-error-0308010c-digital-envelope-routines-unsupported-quot. It does not require downgrading nodejs nor does it require updating all the underlying webpack stuff etc nor does it require the --openssl-legacy-provider flag. It targets the root problem (dropped support for MD4 in OpenSSL 3) and fixes it in a reasonably elegant manner. – Taligrade 6/7, 2022 at 17:50

WARNING: WARNING: WARNING: WARNING: WARNING: WARNING: WARNING: WARNING: If you use the yarn tool, it will default to /usr/bin/node and won't properly follow your PATH. I wasted an HOUR downgrading my Node to all kinds of old versions via the n tool. I still kept getting the error. Finally I uninstalled the distro's nodejs package and NOW Yarn realizes I want to be using the n version in /usr/local/bin/node instead. The error is fixed. There is probably a way to tell Yarn which Node version to use but I had just assumed it would figure that out from PATH, meh. – Reames 21/8, 2022 at 0:56

I get /usr/bin/node: --openssl-legacy-provider is not allowed in NODE_OPTIONS on Fedora 35. – Ferricyanide 8/9, 2022 at 4:52

Adding export NODE_OPTIONS=--openssl-legacy-provider to Home/.zshrc (MAC / Linux Manjaro or any other distro with Zsh) will avoid putting it every time – Pantaloons 5/10, 2022 at 19:45

combining the two options worked for me – Carriole 11/10, 2022 at 11:32

echo 'export NODE_OPTIONS=--openssl-legacy-provider' >> ~/.zshrc works for me. Don't forget to reopen terminal – Levona 4/11, 2022 at 17:8

This solution is not recomended, try to uninstall Node.js version 17+ and reinstall the Node.js version.. – Telamon 7/11, 2022 at 13:41

this actually, helped me for my project that's been lasting for months. However, I feel it's not the best way as I can't install any dependency for my newly created project. – Vocabulary 6/12, 2022 at 11:44

Consider the warnings in this - https://mcmap.net/q/44955/-error-message-quot-error-0308010c-digital-envelope-routines-unsupported-quot - answer before doing this. – Albertinealbertite 11/1, 2023 at 18:42

if you are doing above steps, above error will solve. but new error will comes Line 6: 'React' must be in scope when using JSX react/react-in-jsx-scope – Gadgeteer 12/1, 2023 at 10:57

you can change npm run start in package.json: "start": "react-scripts --openssl-legacy-provider start", that works as well and doesn't require you to change node versions – Holiness 19/1, 2023 at 22:3

This is not a solution, it's the opposite of a solution! This will take away all the benefits of upgrading to a new version with all its security updates. Please don't do this! The real solution is no where to be found so far! – Berth 24/1, 2023 at 9:34

No need to downgrade. I'm using node.js 18 with project built with probably node 14. Injecting the parameters into your start script only fixed the issue for me. – Jamilajamill 25/1, 2023 at 15:17

I added the following line to my .zshrc file and then restarted my session: export NODE_OPTIONS=--openssl-legacy-provider – Brooksbrookshire 26/2, 2023 at 13:1

If the project has other dependencies that relies on the React version you are currently in, then no need to downgrade. just add the '''--openssl-legacy-provider start''' to the react-scripts start. – Diandiana 7/3, 2023 at 9:8

This worked for me. I didn't try it sooner because I though since 18 is LTS, it shouldn't require downgrading. Why is this STILL an issue? – Caddie 7/3, 2023 at 21:48

found that only version 16.13.0 working in this case – Kaohsiung 10/3, 2023 at 14:17

Downgrading worked for me (nvm install 16 && nvm use 16)! – Markham 14/3, 2023 at 9:12

For me set NODE_OPTIONS=--openssl-legacy-provider was all I had to do. No downgrading needed. – Daphnedaphnis 14/3, 2023 at 14:24

It's fairly recent, but Storybook 7.x release candidate has been released. It's built on newer versions and doesn't suffer this issue. You could attempt an upgrade to it: storybook.js.org/docs/7.0/react/get-started/install – Nisan 22/3, 2023 at 20:7

I was on node 19 but then downgrading to 16.18.1 helped me fix the issue. – Lesbos 7/4, 2023 at 9:30

I had this issue when using webpack-dev-server, and using nvm to downgrade Node from v19 to v16.20.0 solved it. Thanks buddy! – Evonevonne 7/4, 2023 at 22:12

In my Mac, export NODE_OPTIONS=--openssl-legacy-provider fix the problem. – Tetragrammaton 18/4, 2023 at 5:54

I have Windows. I typed the special command for Windows in the command line, but I still got an error. I ran the command for Linux in git bash and the problem was solved! – Checky 6/6, 2023 at 15:4

I encountered this issue in my Windows 10 with node v18.16.0. The set NODE_OPTIONS=--openssl-legacy-provider fixes the issue for me. – Dorella 21/6, 2023 at 2:33

nvm use 14.21.2 solved my issue – Oireachtas 18/7, 2023 at 16:32

So, how can I undo "set NODE_OPTIONS=--openssl-legacy-provider"? – Spina 24/7, 2023 at 4:8

On Windows when working on a Preact project I needed to modify the "scripts" section in the package.json from "dev": "preact watch", to "dev": "set NODE_OPTIONS=--openssl-legacy-provider && preact watch". It could be similar for React projects. – Dropsonde 25/7, 2023 at 8:20

Downgrading alone worked for me on Mac. Thank you – Aconite 1/8, 2023 at 11:39

i used it without -- and my app works with node 16.20.1; cross-env NODE_OPTIONS=openssl-legacy-provider ... – Leading 7/8, 2023 at 7:51

I'm using Mac and export NODE_OPTIONS=--openssl-legacy-provider worked for me. – Duppy 8/8, 2023 at 11:39

I had this error when running a legasy angular app in windows. I use a dos batch file to launch the app, so just added this before the ng server command: set NODE_OPTIONS=--openssl-legacy-provider – Transversal 15/8, 2023 at 1:4

export NODE_OPTIONS=--openssl-legacy-provider doesn't work with node below 18 – Teratoid 29/8, 2023 at 16:58

This worked for me with node v18.18. Thanks! – Seminary 26/10, 2023 at 18:45

I've added it into the .npmrc file which I got from this comment: github.com/nodejs/node/issues/40455#issuecomment-1527619752 – Womanish 22/11, 2023 at 11:14

node version was the issue for me. Changed it using nvm use ## – Gorlicki 4/1 at 16:38

it works for me after 24 hours of searching the solution. Thanks @AjoyKarmakar – Rockaway 19/1 at 21:11

it works for me with nodejs version v20.11.0 – Signory 25/1 at 2:46

This solution worked for us. We were running npm run build within the node:lts container image as part of our GitLab CICD pipeline. We just added the NODE_OPTIONS variable as a project variable and re-ran the failed job. – Nicolnicola 31/1 at 20:55

export NODE_OPTIONS=--openssl-legacy-provider this works for me, thank you! – Bellboy 1/3 at 6:7

Had this issue with an older version of storybook. Starting storybook with NODE_OPTIONS=--openssl-legacy-provider start-storybook worked. Thanks. – Somewise 15/3 at 18:28

setting set NODE_OPTIONS=--openssl-legacy-provider on windows worked for me – Crotch 16/3 at 11:5

S

1398

Danger

This question has more than 30 answers, most suggesting to either downgrade Node.js to pre v17 or to use the legacy SSL provider. Both of those solutions are hacks that leave your builds open to security threats.

Reason For The Error

In Node.js v17, the Node.js developers closed a security hole in the SSL provider. This fix was a breaking change that corresponded with similar breaking changes in the SSL packages in NPM. When you attempt to use SSL in Node.js v17 or later without also upgrading those SSL packages in your package.json, then you will see this error.

The Correct (safe) Solution (for npm users)

Use an up-to-date version of Node.js, and also use packages that are up-to-date with security fixes.

You can first try an update to see if that solves the problem:

npm update

If that is not enough, for many people, the following command will fix the issue:

npm audit fix --force

However, be aware that, for complex builds, the above command will pull in breaking security fixes that can potentially break your build.

Note for Yarn users

Yarn users can use yarn-audit-fix which can be run without installing as a dependency via

npm_config_yes=true npx yarn-audit-fix

or windows powershell:

$env:npm_config_yes = 1; npx yarn-audit-fix

A less heavy-handed (also correct) solution for Webpack

In your Webpack config, set either of the following: (See the ouput.hashFunction docs)

A. (Webpack v5) Set output.hashFunction = 'xxhash64'.
B. (Webpack v4) This will depend on what hash algorithms nodejs supports on your system. Some common options you can try are output.hashFunction = 'sha512' or output.hashFunction = 'sha256'.

See more info in Greg's answer.

Siu answered 18/7, 2022 at 19:7 Comment(34)

npm audit fix --force is the only thing that worked for me, but I also had to upgrade all package dependencies in my project first: nodejs.dev/en/learn/… – Ferricyanide 8/9, 2022 at 5:16

I was unable to run an npm audit fix because I am using a proxy that doesn't support it. An alternative was to do an npm audit --regsitry=https://resgistry.npmjs.org and manually inspect the packages to find the offender (in my case elliptic). Look for Use of a Broken or Risky Cryptographic Algorithm. Then manually update that package to a non-offending version. – Claviform 16/9, 2022 at 14:42

@LukeHutchison probably upgrading the packages is what fixed it, not the audit... – Stutzman 8/10, 2022 at 21:41

@vanowm, the audit fix --force upgrades packages in a more heavy-handed way than a regular upgrade. The --force flag upgrades even breaking changes, which is what many (perhaps most?) of us who have this problem need to fix the problem (unless using the less heavy-handed option mentioned in Greg's answer). – Siu 9/10, 2022 at 22:28

@David, in my case using npm update what fixed it, the npm audit fix --force prior that did nothing...just saying. – Stutzman 15/10, 2022 at 11:31

Thank you for the actually sane answer, David. I'm shocked at the number of answers that suggest downgrading node. – Rizo 2/11, 2022 at 17:17

Guys please use npm audit fix --force this works and other options are not safe if you are working on big project – Wainscoting 19/11, 2022 at 10:49

This solution did absolutely nothing to help me - either the "correct safe solution" or the "less heavy handed solution" - it just wasted my time and I got exactly the same error message after trying these fixes. – Ariosto 19/12, 2022 at 16:42

npm audit fix --force COMPLETELY BREAKS MY PROJECT! DAMN – Turpin 20/12, 2022 at 11:31

Yes, it is important to reiterate, this fix can break your build. Be aware before trying this heavy-handed fix. The needed security updates are breaking changes. – Siu 20/12, 2022 at 17:47

@JuliusGoddard, I agree. I am just learning React, following a course released 3 months ago (so relatively up-to-date). I have no idea what any of this is about. But I had 72 audit errors before running npm audit fix --force, and I have 72 errors after. Nothing is fixed. When I tried adding output.hashFunction = 'xxhash64' to my webpack.config.js file (which was not easy to find, BTW), I received this error message:

(node:12080) [DEP0111] DeprecationWarning: Access to process.binding('http_parser') is deprecated. ... output is not defined

– Macaluso 22/12, 2022 at 12:48

@Todd Hoatson I know... the solution is like "don't listen to anyone else, our answer is the best" and it doesn't do anything and screws up people's projects. – Ariosto 22/12, 2022 at 14:15

Hi @David, thanks for your insight. The Webpack configuration you offer seems to only work for v5. I'm using Webpack 4 (Nuxt 2) and output doesn't seems to be a rules property. Any advice to do the same configuration with v4 please? – Nescience 5/1, 2023 at 12:17

Hi @Claire, I have edited with some helps for webpack v4. What works for webpack v4 will depend some on what hash functions your system supports, so some people may need to experiment to find an appropriate option. Hope that helps! – Siu 5/1, 2023 at 16:7

@LukeHutchison the link is dead, did you mean this – Attenuant 9/1, 2023 at 13:16

If you're using YARN, you'll need to use npm to use this fix, here is some documentation that helps: https://mcmap.net/q/45652/-is-there-a-yarn-alternative-for-npm-audit – Battalion 9/1, 2023 at 16:51

For me, using npm i --package-lock-only (because I was using yarn) and then using npm audit fix --force got me from 28 vulnerabilities to 0, so I'd assume that this answer can work. (and can fail, as the author pointed out) – Battalion 9/1, 2023 at 16:53

BUT then I had to randomly upgrade all my packages and then my build finally worked. So, I guess that besides the npm auto fix, some packages were needing an upgrade, too, but I couldn't know which ones. – Battalion 9/1, 2023 at 17:0

I'm experiencing the same issue for a Laravel project with webpack.mix.js. Unfortunately none of the options work, and I find it odd that almost everyone suggests downgrading Node. I attempted npm audit fix, then executed npm audit fix --force which can be a bit more destructive based on project dependencies. Unfortunately the ladder command then broke the project build. Thank you for the suggestions however. – Fourthly 15/1, 2023 at 0:54

None of these worked. – Theodore 15/1, 2023 at 9:33

This fix was a breaking change - it made my day! – Taddeo 8/3, 2023 at 13:52

npm audit fix --force breaks everything I have, every time I use it. Nothing will build. I can start from scratch with create-react-app and that command will break it as well. Need a npm fix audit fix --force first. ha – Mudskipper 21/3, 2023 at 16:48

yarn users can use yarn-audit-fix package, it worked for me in terms of fixing audit errors but didn't fix the issue with SSL unfortunately, – Maciemaciel 29/3, 2023 at 8:25

People, welcome to the land of JS development. Yes, there are complicated dependencies. If you're not willing to work with them and are happy to live with security holes, please get out of this field. – Rhetorician 7/4, 2023 at 23:6

If I build an Angular app using "ng build", this "--openssl-legacy-provider" option fixes the build problem (it appeared after Node.js has been upgraded to v18). The generated app is served statically as transpiled js files. Does using this option pose any security thread in this case? – Alfrediaalfredo 14/4, 2023 at 14:39

Security at the expense of usability, comes at the expense of security :) – Amorous 26/4, 2023 at 11:49

I don't know what webpack use hashFunction to do, but I doubt there's any real word security issue, as in hashFunction's documentation itself, it says "You can provide a non-crypto hash function for performance reasons." So I can hardly agree with "Both of those solutions are hacks that leave your builds open to security threats." – Douglas 24/5, 2023 at 23:53

Thank you for a sane answer. The number of javascript developers that perpetuate this nonsense is utter insanity. – Bodyguard 10/6, 2023 at 11:38

openssl list -digest-algorithms can check what algorithms can digested for webpack v4 – Tasia 19/6, 2023 at 4:42

For me, simply doing pnpm update fixed the error, without force – Panto 11/7, 2023 at 8:28

npm audit fix, without force option, worked for me. Thank you for the hint ;) – Lavona 20/7, 2023 at 7:51

@David's fix is completely wrong and doesn't work. There is NO fix for Webpack 4 other than to downgrade Node or to upgrade to Webpack 5. Astonishing this answer is so upvoted when it doesn't work! – Ixia 21/9, 2023 at 10:51

Thank you, it was helpful to see the consequences of this. However in my case I use a package which creates an 'md4' hash (thus trigger that error), and I need Node 18+ for another package so I could see no other way than using the legacy openssl flag. – Manichaeism 10/12, 2023 at 10:54

This should be the accepted answer. Too many of the other "solutions" are essentially saying, "Leave the door unlocked." -- when the correct solution is, "Fix the lock." – Aweather 8/1 at 18:14

S

1125

In your package.json: change this line

"start": "react-scripts start"

to

"start": "react-scripts --openssl-legacy-provider start"