не работает patch запрос node js react has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource

есть обработчик который передаёт formData в запрос

    const handleUpdateProfile = async () => {
        try {

            const formData = new FormData();
            formData.append("id", _id);
            formData.append("firstName", formValues.firstName);
            formData.append("lastName", formValues.lastName);
            formData.append("email", formValues.email);
            formData.append("occupation", formValues.occupation);

            if (image) {
                formData.append("picture", image);
                formData.append("picturePath", image.name);
            }
            formData.forEach((value, key) => {
                console.log(`${key}: ${value}`);
            });

            const response = await fetch(`http://localhost:3001/users/${_id}`, {
                method: "PATCH",
                headers: {
                    Authorization: `Bearer ${token}`,
                    "Content-Type": "application/json",
                },
                body: formData,
            });

            const responseData = await response.json();
            console.log("Response from server:", responseData);
            //navigate("/home");

        } catch (error) {
            console.error("Error:", error);
        }
    };

controller users.js

/* UPDATE */
export const updateUserData = async (req, res) => {
    try {
        
        const { id } = req.params;
        const updatedUserData = req.body; // Данные для обновления из запроса
        console.log(id);
        // Проверка существования пользователя
        const existingUser = await User.findById(id);
        if (!existingUser) {
            return res.status(404).json({ message: 'User not found' });
        }
        // Обновление текущего пользователя
        const updatedUser = await User.findByIdAndUpdate(id, updatedUserData, { new: true });
        console.log("тут3");
        // Обновление данных у друзей (предполагается, что friends - это массив id друзей)
        if (updatedUser.friends && updatedUser.friends.length > 0) {
            const friendsUpdatePromises = updatedUser.friends.map(async (friendId) => {
                const friend = await User.findById(friendId);
                if (friend) {
                    friend.firstName = updatedUserData.firstName || friend.firstName;
                    friend.lastName = updatedUserData.lastName || friend.lastName;
                    friend.occupation = updatedUserData.occupation || friend.occupation;
                    friend.location = updatedUserData.location || friend.location;
                    friend.picturePath = updatedUserData.picturePath || friend.picturePath;
                    return friend.save();
                }
            });
            await Promise.all(friendsUpdatePromises);
        }
        res.status(200).json(updatedUser);
    } catch (err) {
        res.status(500).json({ message: err.message });
    }
};

routes users.js

import express from "express";
import {
    getUser,
    getUserFriends,
    addRemoveFriend,
    updateUserData,
} from "../controllers/users.js";
import { verifyToken } from "../middleware/auth.js";

const router = express.Router();

/* READ */
router.get("/:id", verifyToken, getUser);
router.get("/:id/friends", verifyToken, getUserFriends);

/* UPDATE */
router.patch("/:id", verifyToken, updateUserData);
router.patch("/:id/:friendId", verifyToken, addRemoveFriend);


export default router;

код сервера:

/* CONFIGURATIONS */
const __filename = fileURLToPath(import.meta.url);
const __dirname = path.dirname(__filename);
dotenv.config();
const app = express();
app.use(express.json());
app.use(helmet());
app.use(helmet.crossOriginResourcePolicy({ policy: "cross-origin" }));
app.use(morgan("common"));
app.use(express.json({ limit: '50mb' }));
app.use(express.urlencoded({ limit: '50mb', extended: true }));
app.use(cors({
    origin: "http://localhost:3000",  // Replace with your frontend's URL
    methods: "GET,HEAD,PUT,PATCH,POST,DELETE",
    credentials: true,
}));
app.use("/assets", express.static(path.join(__dirname, "public/assets")));

/* FILE STORAGE */
const storage = multer.diskStorage({
    destination: function (req, file, cb) {
        cb(null, "public/assets");
    },
    filename: function (req, file, cb) {
        cb(null, file.originalname);
    },
});
const upload = multer({ storage });

/* ROUTES WITH FILES */
app.post("/auth/register", upload.single("picture"), register);
app.post("/posts", verifyToken, upload.single("picture"), createPost);

/* ROUTES */
app.use("/auth", authRoutes);
app.use("/users", userRoutes);
app.use("/posts", postRoutes);
app.use("/conversations", conversationRoutes);
app.use("/messages", messageRoutes);

/* MONGOOSE SETUP */
const PORT = process.env.PORT || 6001;
mongoose
    .connect(process.env.MONGO_URL, {
        useNewUrlParser: true,
        useUnifiedTopology: true,
    })
    .then(() => {
        app.listen(PORT, () => console.log(`Server Port: ${PORT}`));

        /* ADD DATA ONE TIME */
        //User.insertMany(users);
        //Post.insertMany(posts);
    })
    .catch((error) => console.log(`${error} did not connect`));

при нажатии на обновить профиль:enter image description here в чём проблема

если не исползовать FormData всё вроде работает, но без FormData не получается загрузить фото