QID 983778

The problem is fixed in 0.21.27, 0.22.3, 0.23.2, and 1.0.0-M25. The original `CORS` implementation and `CORSConfig` are deprecated. In addition to the origin vulnerability, the following deficiencies in the deprecated version are fixed in the new signatures:Workaround:
It is possible to be safe in unpatched versions, but note the following defects exist: * The `anyMethod` flag, enabled by default, accepts methods that cannot be enumerated in the `Access-Control-Allow-Methods` preflight response. * Rejected CORS requests receive a `403` response, when the client should be the enforcement point. The server should just omit all CORS response headers. * Does not send `Vary: Access-Control-Request-Headers` on preflight requests. This may confuse caches. * Does not validate the `Access-Control-Request-Headers` of a preflight request. This validation is not mandated by the Fetch standard, but is typical of most server implementations. * Needlessly sends `Vary: Access-Control-Request-Method` on non-preflight requests. This should be harmless in practice. * Needlessly sends `Access-Control-Max-Age` header on non-preflight requests. This should be harmless in practice. * Sends an invalid `Access-Control-Allow-Credentials: false` instead of omitting the header. This should be harmless in practice.