nextjs-cors

nextjs-cors adapts the widely-used Express cors middleware for Next.js API routes, which don’t natively expose the (req, res, next) middleware signature Express plugins expect. It wraps cors in a small Promise-based function you can await at the top of any API route handler, giving you the same configuration options (allowed origins, methods, headers, credentials) documented by the underlying cors package.

The implementation is intentionally minimal — a single TypeScript file that bridges Next.js’s request/response objects into the callback-style API the cors package expects — making it easy to audit and unlikely to introduce its own bugs beyond whatever cors itself does.

What You Get

• A single async NextCors(req, res, options) function usable in any Next.js API route handler
• Full pass-through of the cors package’s configuration options (origin, methods, allowed/exposed headers, credentials, preflight status code)
• TypeScript types for Next.js’s NextApiRequest/NextApiResponse built into the function signature
• Zero custom CORS logic — behavior matches the well-known cors package exactly, reducing surprises
• Small bundle footprint since it ships as a thin wrapper with cors as its only runtime dependency

Common Use Cases

• Enabling a Next.js API route to be called cross-origin from a separate frontend deployment or mobile app
• Allowing a public API built with Next.js API routes to be consumed by third-party developers from the browser
• Restricting which origins, methods, or headers are permitted on a set of internal Next.js API endpoints
• Migrating an existing Express app that used cors middleware to Next.js API routes without rewriting CORS config

Under The Hood

Architecture: The entire package is one file, src/index.ts, which wraps the cors package’s callback-based middleware in a Promise: it invokes cors(options)(req, res, callback) and resolves or rejects based on whether the callback receives an Error, letting Next.js API route handlers await NextCors(...) instead of dealing with the (req, res, next) middleware signature Express expects.

Tech Stack: Built with TypeScript and bundled via tsup (producing both CJS and ESM outputs plus .d.ts types), with cors as its sole runtime dependency and next declared as a peer dependency (>=8.1.1-canary.54) so it works across a wide range of Next.js versions; releases are managed with Changesets.

Code Quality: The codebase is a single ~25-line function with no branching logic beyond the Promise/error bridge, so correctness depends almost entirely on the well-established cors package it wraps; there is no dedicated test suite in the repository, meaning correctness is verified indirectly through cors’s own test coverage and real-world usage rather than tests in this repo itself.

API Design: The API mirrors Express usage patterns Next.js developers migrating from Express are likely to already know, and requires no configuration objects of its own — any options object valid for the cors package works unchanged, so there’s effectively zero additional learning curve on top of already knowing cors.