Vapor 4.39.1 has been released.
Link: Release CORS: add "vary: origin" header if allowed origin is .originBased (#2539) · vapor/vapor · GitHub