Why does my JavaScript fetch() call fail with a CORS error when the API works in Postman?

Frontend is a React app served from localhost:3000; backend is an Express API on localhost:5000. Calling fetch('http://localhost:5000/api/items') from the React app. The endpoint returns JSON correctly when tested in Postman.

The fetch call should return the JSON response so I can render the data in my component.

The browser console shows: Access to fetch at 'http://localhost:5000/api/items' from origin 'http://localhost:3000' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.