`@tus/server` `>= v2.1.0` seems now incompatible with Next.js pages API

[sneko]

Initial checklist

• I understand this is a bug report and questions should be posted in the Community Forum
• I searched issues and couldn’t find anything (or linked relevant results below)

Steps to reproduce

Make sure to use between v2.1.0-v2.3.0, and within the pages API router just use :

const tusServer = new Server({
  path: '/api/upload',
});

export function handler(req: NextApiRequest, res: NextApiResponse) {
  return tusServer.handle(req, res);
}

(as shown in https://uppy.io/docs/nextjs/#pages-router)

And then start uploading a file (using Uppy client aside for example).

Expected behavior

To have Location response header like in:

HTTP/1.1 201 Created
origin-agent-cluster: ?1
referrer-policy: no-referrer
strict-transport-security: max-age=15552000; includeSubDomains
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-download-options: noopen
x-frame-options: SAMEORIGIN
x-nonce: xxxxx
x-permitted-cross-domain-policies: none
x-xss-protection: 0
access-control-allow-origin: http://localhost:3000
access-control-expose-headers: Authorization, Content-Type, Location, Tus-Extension, Tus-Max-Size, Tus-Resumable, Tus-Version, Upload-Concat, Upload-Defer-Length, Upload-Length, Upload-Metadata, Upload-Offset, X-HTTP-Method-Override, X-Requested-With, X-Forwarded-Host, X-Forwarded-Proto, Forwarded
content-type: text/plain;charset=UTF-8
location: http://localhost:3000/api/upload/f1d627f06be68560949c3125d9644381
tus-resumable: 1.0.0
Vary: Accept-Encoding
Date: Mon, 27 Oct 2025 21:20:19 GMT
Connection: keep-alive
Keep-Alive: timeout=5
Transfer-Encoding: chunked

Actual behavior

Having no Location response header, and moreover having broken response headers like:

HTTP/1.1 201 
1: .
origin-agent-cluster: ?1
referrer-policy: no-referrer
strict-transport-security: max-age=15552000; includeSubDomains
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-download-options: noopen
x-frame-options: SAMEORIGIN
x-nonce: xxxxxxxxx
x-permitted-cross-domain-policies: none
x-xss-protection: 0
A: u
h: t
c: o
t: u
l: o
Date: Mon, 27 Oct 2025 21:21:40 GMT
Connection: keep-alive
Keep-Alive: timeout=5
Transfer-Encoding: chunked

After searching I found tus/tus-js-client#694 (pointing to expressjs/morgan#315) that advises patching on-headers with v1.1.0 but it's not working at all.

Looking at the changelog it seems srvx is the new thing in @tus/server v2.1.0 so I guess it comes from this.

For the moment, just sticking with v2.0.0 as it's working 👍

Thank you,