These formats cannot be loaded due to CORS

I’ve created the Static Context and I write down the following codes

Access-Control-Allow-Origin *
Access-Control-Allow-Methods GET, POST, OPTIONS, DELETE

when I check with CURL curl -I, but I still get CORS warning in browser’s console for only these formats: “woff2, woff, ttf” warning for CORS.

What could be the reason?