Your backend isn't sending CORS headers that allow your frontend's origin. Install and configure the `cors` package with your frontend's exact URL(s), and make sure it's applied before your routes are registered.