Postmortem: How a Misconfigured CORS Policy in React 19 and Express 5.0 Leaked User Data

In Q3 2024, a misconfigured CORS policy between React 19’s new strict origin checking and Express 5.0’s deprecated cors middleware defaults exposed 142,000 user PII records over 72 hours before detection. This is the definitive postmortem of what wen...