Cross Origin Resource Sharing (CORS) is a way to punch hole in the security brought by a browser. If it is not done carefully, it may result into security vulnerabilities. CORS is an HTTP-header that allows a server to indicate any origins (domain, scheme, or port) other than its own from which a browser should permit loading resources. `null` can be set by server for various reasons including support for local development. However, whitelisting `null` could be dangerous as some crafted requests e.g. `iframe` can have `null` origin and allows an adversary to access the resource cross-domain.

Remediation

Do not set `null` origin.