Vulnerability · Published Jun 12, 2026 · Assigned by GitHub_M

CVE-2026-47216Typesense: Unauthenticated Denial of Service in the Typesense /multi_search Endpoint

High 8.7

In plain English

A high-severity security flaw in typesense from typesense. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities).

Severity (CVSS 4.0)8.7High

Exploit odds (30 days)0.3%top 72.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Typesense is a fast, typo-tolerant search engine. Prior to versions 29.1 and 30.2, there is an unauthenticated denial-of-service vulnerability in the /multi_search endpoint. A specially crafted request can trigger an unhandled exception during request processing, causing the server process to terminate. This issue can be exploited over the network without authentication and results in service unavailability. The duration of impact may vary depending on system configuration and dataset size. This issue has been patched in versions 29.1 and 30.2.

Affected products (as reported)

Vendor	Product	Versions
typesense	typesense	< 29.1>= 30.0, < 30.2

Weakness: CWE-754 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

https://github.com/typesense/typesense/security/advisories/GHSA-fpx5-8c99-247j x_refsource_CONFIRM