Environment

h3 1.15.3 but the bug is still in the main branch

Reproduction

I don't think the repro is needed as the bug is obvious by looking at the code. Let me know if you absolutely require it.

Describe the bug

h3 cors module has some default options:

However they are not actually used when generating CORS headers (only what the user explicitly passes is used):

As the result, preflight response doesn't include access-control-allow-methods: * despite it being the default value.

Additional context

No response

Logs