An unauthenticated endpoint in Typesense’s /multi_search can be triggered with a specially crafted request, causing an unhandled exception that terminates the server process. The result is a complete loss of service until it is restarted, which can disrupt search availability for applications relying on Typesense.

The vulnerability affects all instances of Typesense, specifically versions older than 29.1 and 30.2. These release dates are documented as the point where the issue was patched.

The CVSS score of 8.7 indicates a high severity of this denial‑of‑service flaw. With an EPSS score of less than 1%, the likelihood of exploitation is low, and the vulnerability is not listed in the CISA KEV catalog. Exploitation is possible from any network location that can reach the /multi_search endpoint without authentication, and the attack vector is inferred to be remote network access because the request can be sent over the network and does not require privileged access to the server.