INCIDENT RUNBOOK
Fix: Cors Preflight Origin Mismatch in NestJS on Kubernetes
Comprehensive architectural post-mortem and verified configuration patch for nestjs deployed in kubernetes production environments.
Automated Remediation ProtocolUpdated for 2026 Production
Facing cors-preflight-origin-mismatch in CI/CD or runtime containers?
Review the verified configuration patches below. To automate incident triage and fine-tune your own internal agents, check out our production AI training datasets.
● Observed Terminal Error / Stack Trace
ERROR [ExceptionsHandler] Cors Preflight Origin Mismatch at CorsMiddleware.call (/app/node_modules/@nestjs/common/utils/cors.util.js:22:23) at /app/node_modules/@nestjs/core/router/router.js:100:32 at Layer.handle [as handle_request] (/app/node_modules/express/lib/router/layer.js:95:5) at Router.next (/app/node_modules/express/lib/router/index.js:275:10) at CorsMiddleware.call (/app/node_modules/@nestjs/common/utils/cors.util.js:20:20) at /app/node_modules/@nestjs/core/router/router.js:100:32
Root Cause Analysis
The Cors Preflight Origin Mismatch error occurs when the browser sends a preflight request to the server to determine which HTTP methods and headers are allowed for a specific resource. In a Kubernetes environment, this error can be caused by a mismatch between the origin of the request and the allowed origins configured in the NestJS application. This mismatch can arise from a variety of sources, including incorrect configuration of the Cors middleware in NestJS, or network policies in Kubernetes that restrict traffic between pods or services. The root cause is often related to the way the application is configured to handle cross-origin resource sharing (CORS), particularly in environments where multiple services are deployed across different domains or subdomains.
● Configuration & Code Resolution
To fix the Cors Preflight Origin Mismatch error, update the `main.ts` file to include the correct Cors configuration. Specifically, modify the `CorsOptions` to include the correct allowed origins. Here is an example of the configuration diff:
--- a/src/main.ts
+++ b/src/main.ts
@@ -10,6 +10,10 @@
import { NestFactory } from '@nestjs/core';
import { AppModule } from './app.module';
+const corsOptions = {
+ origin: ['http://example1.com', 'http://example2.com'],
+ methods: 'GET,HEAD,PUT,PATCH,POST,DELETE',
+ allowedHeaders: 'Content-Type, Accept',
+};
+
const app = await NestFactory.create(AppModule);
+app.use(cors(corsOptions));
await app.listen(3000);Verification & Build Command
curl -X OPTIONS -H 'Origin: http://example1.com' -H 'Access-Control-Request-Method: GET' -i http://localhost:3000/api/resource