Node.js 18+ (OpenSSL 3)

Error: error:0308010C:digital envelope routines::unsupported

Error: error:0308010C:digital envelope routines::unsupported

What it means

Node.js 17+ ships OpenSSL 3, which rejects the legacy hashing some older build tools rely on.

Why it happens

OpenSSL 3 disables legacy algorithms (e.g. the MD4-based hashing webpack 4 uses by default). Upgrading a Lambda or container to a Node 18/20/22 runtime surfaces this during a build or in crypto calls.

How to fix it

Durable fix: upgrade the offending tooling to an OpenSSL-3-safe version (e.g. webpack 5, react-scripts 5+).
Stopgap only: set `NODE_OPTIONS=--openssl-legacy-provider` to re-enable the legacy provider — this re-enables weak crypto, so treat it as temporary.
In your own code, replace deprecated hashes (md4/md5 used for security) with sha256.
Rebuild and redeploy on the target Node version.

Related deadline: Lambda Node.js 18 create/update restrictions — 2027-02-01.

Check configured patterns in your project

The free EOLkits scanner processes files in your browser and flags selected related patterns in supported IaC and dependency files. File names and contents are not uploaded; bounded aggregate file and finding counts may be sent. It is not a complete source or AWS-account scan.

Prefer a 10-second check? Paste your config into the free AWS EOL checker. Pasted input is not uploaded; bounded first-party usage events may be sent.

Primary source: https://nodejs.org/api/cli.html#--openssl-legacy-provider

Inspect the $299 report sample and availability →