Multiple ‘Access-Control-Allow-Origin’ headers are being sent

Initial checklist

• I understand this is a bug report and questions should be posted in the Community Forum
• I searched issues and couldn’t find anything (or linked relevant results below)

Steps to reproduce

I am implementing file upload functionality using tus and this is a basic tus server setup code

const tusServer: Server = new Server({
    path: '/app/upload/media',
    datastore: new FileStore({
        directory: imagesPath,
        configstore: config
    }),
    allowedOrigins: [],
    exposedHeaders: [''],
    allowedHeaders: [''],
    respectForwardedHeaders: true,
    namingFunction: async (req: Request, metadata?: Record<string, string | null>): Promise<string> => {
        if (metadata?.filename) return metadata?.filename;
        return "";
    },

The issue is that even thought I have set allowedOrigins: , it is still sending header “*” in response. which is causing CORS error on the FE. My BE framework also sends a Access-Control-Allow-Origin which causes the issue. Can tus ignore the Access-Control-Allow-Origin header all together if I have provided an empty list?

This is what I got on FE,

Expected behavior

There should be an option to override the headers or remove them all together

Actual behavior

Tus is managing the headers all by itself and cannot be overriden.

Start at the TypeScript Server configuration shown in the report, focusing on allowedOrigins and how response headers are produced. Reproduce the setup alongside the backend framework's CORS handling and inspect the response. Done means an empty allowedOrigins configuration no longer adds a conflicting Access-Control-Allow-Origin header, or provides the requested override, with regression coverage.