How can I fix Content Security Policy Wildcard directive vulnerability? - security

Question

I've trying some solutions to fix a CSP Wildcard directive, I'm actually using nginx add_header to protect contents in my website. I tried many aways to secure it correctly, but OWASP ZAP scanner is always getting CSP Wildcard directive
I Know probability I'm forgetting to set a import stuff on it; Anyone has any ideia how can I fix to vulnerability issue CSP Wildcard directive ?
I'll share all headers added to nginx config file:
add_header Content-Security-Policy "default-src 'self' https://my-domain.com; script-src 'report-sample' 'self'; style-src 'report-sample' 'self' https://cdn.jsdelivr.net https://fonts.googleapis.com 'sha256-47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=' 'sha256-FJUTtaihJDaYMVkI25A8Y0YFELvhfzsiIgk6h+OHIMM='; object-src 'none'; base-uri 'self'; connect-src 'self'; font-src 'self' https://cdn.jsdelivr.net https://fonts.gstatic.com; frame-src 'self'; img-src 'self' https://res.cloudinary.com; manifest-src 'self'; media-src 'self'; frame-ancestors https://my-domain.com; report-uri https://630f6a5f23064c2afafa6b30.endpoint.csper.io/?v=0; worker-src 'none';";
add_header 'Access-Control-Allow-Origin' 'https://my-domain.com' always;
add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS' always;
add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range' always;
add_header X-Frame-Options DENY;
add_header X-Content-Type-Options nosniff;
add_header X-XSS-Protection 1;
add_header Strict-Transport-Security: max-age=31536000;
add_header X-Content-Type-Options "nosniff";
add_header Expect-CT 'enforce; max-age=7776000';
add_header X-Frame-Options "ALLOW-FROM my-domain.com";