Can you not call fetch() to do a HEAD call? Maybe I'm mistaken about it but it should be ok.

CORS is indeed a wrench that gets thrown in when you least expect it...