Bug: Only the last setCookie takes effect on the server route

Which project does this relate to?

Start

Describe the bug

When trying to set multiple cookies in a server handler using setCookie, only the last cookie gets actually set in the browser. All previous setCookie calls seem to be overridden or ignored.

Your Example Website or App

https://github.com/Mr-Alexandre/bug-repro-tanstack-start-cookie

Steps to Reproduce the Bug or Issue

1. Start the dev server (e.g., pnpm dev).
2. Open your browser and go to http://localhost:3000/api/set-cookies.
3. Open DevTools → Network tab → Select the request to /api/set-cookies.
4. Check the "Set-Cookie" headers in the Response Headers.
5. You will see that only the last cookie is set.

Expected behavior

As a user, I expected multiple Set-Cookie headers to be sent and both cookies to be set, but I am seeing only the last one is applied. The previous one is missing.

Screenshots or Videos

https://github.com/user-attachments/assets/cbbc9ff2-c8c7-44d3-9c4b-76c4471191c7

Platform

• Router / Start Version: [e.g. 1.121.0]
• OS: [macOS]
• Browser: [Chrome]
• Browser Version: [140.0.7339.214]
• Bundler: [vite]
• Bundler Version: [7.1.7]

Additional context

This bug happens consistently and prevents setting multiple cookies for auth/session scenarios. Possibly related to how Response headers are managed in TanStack Start server handlers.

Start with the /api/set-cookies route in the linked reproduction and run it with pnpm dev. Trace how the server handler creates and passes response headers, focusing on why repeated Set-Cookie values are replaced. Done means the response contains multiple Set-Cookie headers and both cookies are present in the browser.