receiving duplicate cors headers

[samvandb]

I'm receiving ui-avatars from my users to use as their profile picture.

I'm using xhr to fetch these images, but they are sent with doubled cors headers resulting in the following header
Access to image at 'https://eu.ui-avatars.com/api/?name=Sam%20Vdb&size=120$1629186020453' from origin 'http://localhost:3000' has been blocked by CORS policy: The 'Access-Control-Allow-Origin' header contains multiple values '*, *', but only one is allowed.

header list

access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Accept, X-Requested-With, remember-me
access-control-allow-headers: Content-Type, Accept, X-Requested-With, remember-me
access-control-allow-methods: GET, OPTIONS
access-control-allow-methods: GET, OPTIONS
access-control-allow-origin: *
access-control-allow-origin: *
access-control-max-age: 1814400
access-control-max-age: 3600
...