I made a mistake by incorrectly defining the script to run the server.js file in package.json. As a result, it was running an old build from the dist folder instead of running server.js file directly: INCORRECT:

 "scripts": {
    ...
    "start": "node dist/server.js"
  },

CORRECT:

 "scripts": {
    ...
    "start": "node src/server.js"
  },

Since I'm note using build, dist content is outdated and not used. Directly running server.js file solves the CORS issue!