Index: package-lock.json
===================================================================
--- package-lock.json	(revision 43966)
+++ package-lock.json	(working copy)
@@ -1,6 +1,6 @@
 {
 	"name": "WordPress",
-	"version": "5.0.0",
+	"version": "5.1.0",
 	"lockfileVersion": 1,
 	"requires": true,
 	"dependencies": {
@@ -3643,6 +3643,7 @@
 					"version": "1.0.5",
 					"bundled": true,
 					"dev": true,
+					"optional": true,
 					"requires": {
 						"delayed-stream": "~1.0.0"
 					}
@@ -3705,7 +3706,8 @@
 				"delayed-stream": {
 					"version": "1.0.0",
 					"bundled": true,
-					"dev": true
+					"dev": true,
+					"optional": true
 				},
 				"delegates": {
 					"version": "1.0.0",
@@ -3993,12 +3995,14 @@
 				"mime-db": {
 					"version": "1.27.0",
 					"bundled": true,
-					"dev": true
+					"dev": true,
+					"optional": true
 				},
 				"mime-types": {
 					"version": "2.1.15",
 					"bundled": true,
 					"dev": true,
+					"optional": true,
 					"requires": {
 						"mime-db": "~1.27.0"
 					}
@@ -4074,7 +4078,8 @@
 				"number-is-nan": {
 					"version": "1.0.1",
 					"bundled": true,
-					"dev": true
+					"dev": true,
+					"optional": true
 				},
 				"oauth-sign": {
 					"version": "0.8.2",
Index: src/wp-includes/rest-api.php
===================================================================
--- src/wp-includes/rest-api.php	(revision 43966)
+++ src/wp-includes/rest-api.php	(working copy)
@@ -527,7 +527,11 @@
 
 /**
  * Sends Cross-Origin Resource Sharing headers with API requests.
- *
+ * 
+ * Note: Any incoming Origin URL is verified against a safe-list of Origins
+ * using the Allowed Origin API, before these headers are sent.
+ * {@see 'allowed_http_origins'} filter on how to add an Origin to this list 
+ * 
  * @since 4.4.0
  *
  * @param mixed $value Response data.
@@ -535,8 +539,8 @@
  */
 function rest_send_cors_headers( $value ) {
 	$origin = get_http_origin();
-
-	if ( $origin ) {
+	$allowed_origins = get_allowed_http_origins();
+	if ( $origin && in_array( $origin, $allowed_origins ) {
 		// Requests from file:// and data: URLs send "Origin: null"
 		if ( 'null' !== $origin ) {
 			$origin = esc_url_raw( $origin );