Which versions of Typesense are affected by CVE-2026-47216?

Typesense search engine versions prior to 29.1 and 30.2 are vulnerable to unauthenticated denial-of-service attacks that immediately terminate the server process, requiring manual restart and full…. A patch is available.

How to fix or mitigate CVE-2026-47216?

Within 24 hours: Identify all Typesense deployments and confirm affected versions (prior to 29.1 and 30.2); immediately restrict network access to the /multi_search endpoint using firewall rules or network segmentation. Within 7 days: Attempt upgrade to Typesense 29.1, 30.2, or later if available from vendor; if no patched version exists, implement rate limiting on /multi_search and deploy WAF rules to detect malformed requests. Within 30 days: Monitor Typesense security advisories for patch release confirmation; if no patch emerges, establish automated failover/restart procedures and consider evaluating alternative search solutions.

Typesense CVE-2026-47216

Q: What is the CVSS score of CVE-2026-47216?

CVE-2026-47216 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-36512 HIGH

Improper Check for Unusual or Exceptional Conditions (CWE-754)

2026-06-12 GitHub_M

Information Disclosure Typesense

8.7

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Endpoint is reachable over the network with no auth or user interaction; a single crafted request crashes the process, giving high availability impact only, with no confidentiality or integrity effect and no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 12, 2026 - 19:01 EUVD

Analysis Generated

Jun 12, 2026 - 18:17 vuln.today

DescriptionCVE.org

Typesense is a fast, typo-tolerant search engine. Prior to versions 29.1 and 30.2, there is an unauthenticated denial-of-service vulnerability in the /multi_search endpoint. A specially crafted request can trigger an unhandled exception during request processing, causing the server process to terminate. This issue can be exploited over the network without authentication and results in service unavailability. The duration of impact may vary depending on system configuration and dataset size. This issue has been patched in versions 29.1 and 30.2.

AnalysisAI

Unauthenticated denial-of-service in Typesense search engine versions prior to 29.1 and 30.2 allows remote attackers to terminate the server process by sending a crafted request to the /multi_search endpoint. The flaw triggers an unhandled exception during request processing, causing complete service unavailability for the duration of restart and dataset reload. No public exploit identified at time of analysis, and the low EPSS score (0.10%) suggests limited current exploitation interest despite the high CVSS 4.0 score of 8.7.

Technical ContextAI

Typesense is an open-source, typo-tolerant search engine written in C++ commonly deployed as a backend for application search features, often as an alternative to Elasticsearch or Algolia. The vulnerable /multi_search endpoint accepts batched search queries and, per the advisory, fails to handle a specific malformed input pattern, resulting in an unhandled C++ exception that crashes the process. The CWE-754 (Improper Check for Unusual or Exceptional Conditions) root cause indicates the parsing or query-handling logic does not validate or catch an edge case before it propagates up the stack. The affected CPE cpe:2.3:a:typesense:typesense covers all versions of the product prior to the fixed releases.

RemediationAI

Vendor-released patch: upgrade to Typesense 29.1 if on the 29.x branch, or 30.2 if on the 30.x branch, as documented in advisory https://github.com/typesense/typesense/security/advisories/GHSA-fpx5-8c99-247j. Until upgrade is possible, restrict network reachability of the /multi_search endpoint to trusted application backends only via firewall, reverse-proxy ACLs, or a service mesh - note that this breaks any direct browser-to-Typesense search patterns and requires routing client search through your own backend. Rate-limiting and request-size limits on /multi_search at an upstream proxy reduce crash frequency but do not prevent a single malformed request from terminating the process, so pair with a process supervisor (systemd Restart=always, Kubernetes liveness probe) to minimize downtime per crash.