TL;DR: Node 17 and newer ship OpenSSL 3, which removed the MD4 hash that webpack 4 uses internally. Set the NODE_OPTIONS environment variable to --openssl-legacy-provider for the build command and it will pass again. Treat that as a bridge: the durable fix is upgrading to webpack 5, which uses a supported hash.

## The error

```text
"error:0308010C:digital envelope routines::unsupported" after a node upgrade broke a webpack 4 build
```

## Steps to fix

1. Confirm the trigger: node -v prints 17 or newer, and the stack trace mentions digital envelope routines or createHash.
   Expected: You have Node 17 plus with a webpack 4 (or old tooling) build.

2. Rerun the build with the legacy provider: NODE_OPTIONS=--openssl-legacy-provider npm run build (use the env-setting syntax for your shell and CI).
   Expected: The build completes and emits bundles as before.

3. Persist it where the build runs: add NODE_OPTIONS to the CI env block, the Dockerfile ENV, or a .env file the build reads.
   Expected: CI goes green without anyone remembering the flag.

4. Plan the real fix: upgrade to webpack 5 (or replace the MD4-dependent plugin), then remove the flag.
   Expected: The build passes on modern Node with no legacy provider.

## Use this when

- A webpack 4 build fails with error:0308010C digital envelope routines unsupported after a Node upgrade
- CI moved to Node 18 or 20 and a legacy frontend build broke at hash time
- An agent upgraded Node in a repo and needs the minimal unblock before the real webpack 5 migration

## Not for this skill when

- Webpack 5 builds failing on modern Node, which do not use MD4 and have a different cause
- Out-of-memory build crashes, which are resource problems
- Babel or loader syntax errors, which fail before hashing

## Variant phrasings

- Error: error:0308010C:digital envelope routines::unsupported
- webpack build fails after upgrading node to 18
- createHash md4 not supported on node 20

## Why it happens

Webpack 4 computes chunk hashes with MD4 for speed. Node 16 bundled OpenSSL 1.1, which still offered MD4; Node 17 moved to OpenSSL 3, whose default provider set excludes MD4 as a legacy algorithm. The hashing call then fails inside OpenSSL with error:0308010C. The legacy provider flag re-enables the old algorithms for that process, and webpack 5 switched to a modern hash so it never hits this.

## Edge cases

- Some minimal container images strip the legacy provider module; if the flag does not help, check the image's OpenSSL build.
- The flag must be set for every process that runs webpack (dev server too), not just the production build.
- Node 22 and later keep supporting the flag, but each major upgrade is a good moment to finally do the webpack 5 migration.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_pQfTlJlM1pYhUfmIfUhMdw