You should add an if check here to only pass the CORS headers for the fonts that need if, and move this above the express.static block