From a365ab8c6eebe558b784c71c31c2df450a7b2b5d Mon Sep 17 00:00:00 2001
From: Aditya Kumar Mishra <adityakumar.mishra3566@gmail.com>
Date: Wed, 6 May 2026 01:44:00 +0530
Subject: [PATCH] fix(s3): add no-transform cache-control directive to prevent
 payload mutation

---
 src/storage/protocols/s3/s3-handler.ts | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/src/storage/protocols/s3/s3-handler.ts b/src/storage/protocols/s3/s3-handler.ts
index 62efbde4c..9d2fdbc70 100644
--- a/src/storage/protocols/s3/s3-handler.ts
+++ b/src/storage/protocols/s3/s3-handler.ts
@@ -977,6 +977,12 @@ export class S3ProtocolHandler {
       headers['expires'] = command.ResponseExpires.toUTCString()
     }
 
+    if (headers['cache-control']) {
+      headers['cache-control'] += ', no-transform'
+    } else {
+      headers['cache-control'] = 'no-transform'
+    }
+
     return {
       headers,
       responseBody: response.body,