diff --git a/.changeset/dirty-oranges-search.md b/.changeset/dirty-oranges-search.md
new file mode 100644
index 0000000..210a177
--- /dev/null
+++ b/.changeset/dirty-oranges-search.md
@@ -0,0 +1,5 @@
+---
+"@open-frames/proxy": patch
+---
+
+fix: handle errors and return correct CORS headers on error responses
diff --git a/packages/server/src/handlers.ts b/packages/server/src/handlers.ts
index 6747c6d..d7a30c6 100644
--- a/packages/server/src/handlers.ts
+++ b/packages/server/src/handlers.ts
@@ -32,7 +32,7 @@ export async function handlePost(req: Request) {
 	const body = await req.json();
 	console.log(`Processing POST request for ${url}`);
 	if (!url) {
-		return new Response('Missing url query param', { status: 400 });
+		return new Response('Missing url query param', { status: 400, headers: CORS_HEADERS });
 	}
 	const data = await postAndExtract(url, body);
 
diff --git a/packages/server/src/index.ts b/packages/server/src/index.ts
index bc507db..3a6deb7 100644
--- a/packages/server/src/index.ts
+++ b/packages/server/src/index.ts
@@ -12,27 +12,27 @@ export async function handleRequest(req: Request): Promise<Response> {
 		const path = getRequestPath(req);
 		if (req.method === 'GET') {
 			if (path === '/media') {
-				return handleMedia(req);
+				return await handleMedia(req);
 			}
 
 			if (path === '/') {
-				return handleGet(req);
+				return await handleGet(req);
 			}
 		}
 
 		if (req.method === 'POST') {
 			if (path === '/redirect') {
-				return handleRedirect(req);
+				return await handleRedirect(req);
 			}
 
-			return handlePost(req);
+			return await handlePost(req);
 		}
 	} catch (e) {
 		if (e instanceof ErrorResponse) {
-			return Response.json({ error: e.message }, { status: e.statusCode });
+			return Response.json({ error: e.message }, { status: e.statusCode, headers: CORS_HEADERS });
 		}
-		return Response.json({ error: e }, { status: 500 });
+		return Response.json({ error: e }, { status: 500, headers: CORS_HEADERS });
 	}
 
-	return new Response('Not found', { status: 404 });
+	return new Response('Not found', { status: 404, headers: CORS_HEADERS });
 }