This is a nasty thing that's mostly the applications fault but I feel the browser could be a little more smart about it too. The issue is that CORS headers are usually set at the application level, and applications often forget to set them when catching an error.

So if for instance your page makes a CORS request and the MySql server is away. Your app framework catches the error and renders the 500 message, but it doesn't automatically set the CORS.

Now your page receives a response that just gets flat out rejected, you can't even inspect it in the network tab.

The easiest solution is probably to set the CORS headers in NGINX.