CVE-2026-47216: Typesense Search Engine DoS Vulnerability

CVE-2026-47216 Overview

CVE-2026-47216 is an unauthenticated denial-of-service vulnerability in Typesense, a fast, typo-tolerant search engine. The flaw resides in the /multi_search endpoint and affects versions prior to 29.1 and 30.2. A specially crafted request triggers an unhandled exception during request processing, terminating the server process. Because the endpoint is reachable over the network without authentication, any remote attacker can disrupt search service availability. The vulnerability is tracked under CWE-754: Improper Check for Unusual or Exceptional Conditions.

Critical Impact
An unauthenticated remote attacker can crash the Typesense server with a single crafted HTTP request to /multi_search, causing service unavailability whose duration depends on dataset size and restart configuration.

Affected Products

Typesense versions prior to 29.1
Typesense versions prior to 30.2
Any deployment exposing the /multi_search HTTP endpoint

Discovery Timeline

2026-06-12 - CVE-2026-47216 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-47216

Vulnerability Analysis

The vulnerability affects Typesense's /multi_search HTTP endpoint, which allows clients to batch multiple search queries into a single request. When the server parses a specifically malformed payload, request processing raises an exception that is not caught by the handler. The uncaught exception propagates up and terminates the server process. Because Typesense is typically deployed as the sole search backend for an application, process termination removes search functionality entirely until the service restarts. Recovery time depends on dataset size, persistence configuration, and the orchestration layer responsible for restarting the binary.

Root Cause

The root cause is improper handling of an exceptional condition during request parsing or query execution in /multi_search, classified as [CWE-754]. The code path does not validate or guard against the specific input shape that triggers the exception, and no surrounding try/catch boundary contains the failure. As a result, an error that should produce an HTTP 4xx response instead terminates the entire process.

Attack Vector

Exploitation requires only network reachability to the Typesense HTTP API. No authentication, API key, or user interaction is needed for the crash itself, since the unhandled exception occurs during request processing before or independent of authentication outcomes in vulnerable code paths. An attacker sends a single crafted HTTP POST to /multi_search, and the server process exits. Repeated requests after restart sustain the denial-of-service condition. The vulnerability mechanism is described in the Typesense GitHub Security Advisory GHSA-fpx5-8c99-247j.

Detection Methods for CVE-2026-47216

Indicators of Compromise

Unexpected Typesense process termination or repeated restarts logged by the service manager (systemd, Kubernetes, Docker).
HTTP 5xx responses or connection resets immediately following POST requests to /multi_search.
Absence of a graceful shutdown message in Typesense logs prior to process exit.
Spikes in /multi_search request volume from a single source preceding outages.

Detection Strategies

Monitor Typesense process uptime and alert on abnormal restart frequency.
Inspect web access logs and reverse proxy logs for malformed or anomalously structured payloads sent to /multi_search.
Correlate process exit events with the last HTTP request handled to identify crash-triggering payloads.

Monitoring Recommendations

Forward Typesense stdout, stderr, and orchestrator events to a centralized logging platform for crash correlation.
Configure alerts on /multi_search 5xx error rates and abnormal latency.
Track unauthenticated request volume to the Typesense API and rate-limit at the proxy layer.

How to Mitigate CVE-2026-47216

Immediate Actions Required

Upgrade Typesense to version 29.1, 30.2, or later as published in the vendor advisory.
Restrict network access to the Typesense API so it is reachable only from trusted application servers.
Enforce API key authentication on all Typesense endpoints and reject anonymous traffic at the reverse proxy.
Place Typesense behind a process supervisor that restarts the service automatically on crash to reduce outage duration.

Patch Information

The Typesense maintainers patched this issue in versions 29.1 and 30.2. Operators should upgrade directly from the official Typesense release channel. Patch and remediation guidance is provided in the GitHub Security Advisory GHSA-fpx5-8c99-247j.

Workarounds

Block or filter requests to /multi_search at a reverse proxy or web application firewall until the upgrade is applied.
Require an authenticated API key header at the proxy and drop requests lacking it before they reach Typesense.
Apply per-source rate limits to /multi_search to reduce sustained denial-of-service impact.

bash

# Example NGINX configuration to require API key and rate-limit /multi_search
limit_req_zone $binary_remote_addr zone=ts_ms:10m rate=10r/s;

server {
    listen 443 ssl;
    server_name search.example.com;

    location /multi_search {
        if ($http_x_typesense_api_key = "") { return 401; }
        limit_req zone=ts_ms burst=20 nodelay;
        proxy_pass http://typesense_backend;
    }
}