By default CORS middleware allows PATCH method too.

sources/MVCFramework.Middleware.CORS.pas

@@ -58,7 +58,7 @@   TMVCCORSDefaults = class sealed
     /// The Access-Control-Allow-Methods response header specifies the method or methods allowed when accessing the resource in response to a preflight request.
     /// Source: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Methods
     /// </summary>
-    ALLOWS_METHODS = 'POST,GET,OPTIONS,PUT,DELETE';
+    ALLOWS_METHODS = 'POST,GET,OPTIONS,PUT,DELETE,PATCH';
     /// <summary>
     /// Indicates the number of seconds (60 by default) the information provided by
     /// the `Access-Control-Allow-Methods` and `Access-Control-Allow-Headers` headers can be cached.