Misconfigured CORS is no worse than someone using curl, or postman, or any other tool of that kind. What could compromise your server is the backend side of things, the frontend is just a limited HTTP client in the end. The real risk is those making direct requests to your server. CORS is just an ask for browsers specifically to stop cross domain communication, it protects the users not you.
You can help that a lot by using containers like Docker or Podman, but you should also make sure your backend is secure. But the most risk really even then would usually be, break into your database via SQL injection or something like that, still not breaking into the whole instance.
If anything, making sure to use SSH keys, disable root login and general server best practices is way more important than your app. You're more likely that your server itself will be attacked than the backend. Security comes in layers.
But realistically you'll be fine, and if you do end up hacked, it's a learning experience.