Tuesday's attack started with car bombs. An earlier estimate had put the death toll at 15.
Kenyan President Uhuru Kenyatta vowed authorities would "pursue relentlessly" those involved in the funding, planning and execution of the attack.
In a televised address, Kenyatta said that "multiple security efforts are underway to detect, deter, disrupt and defeat any terrorist operative or group." He added that all militants who stormed the site had been killed by security forces.
Let our news meet your inbox. The news and stories that matters, delivered weekday mornings.
"We're grieving as a country and my heart and that of every Kenyan goes out to the innocent victims," Kenyatta said. "We are also a nation that never forgets those who hurt our children."
Sporadic gunfire could be heard from the scene in the morning after scores of people were rescued at daybreak as police continued what they called a mopping-up exercise.
The Red Cross reported that at least 30 people were treated for injuries in hospitals and other health facilities.
Al-Shabab — the Somalia-based Islamic extremist group that is allied to al Qaeda — claimed responsibility for the carnage in a statement. However, that claim had not been verified by authorities.
The State Department confirmed to NBC News that a U.S. citizen was among the dead.
Officials did not release his identity, but his mother, Sarah Spindler, confirmed to NBC News that American victim was her son, Jason Spindler. She said the 40-year-old had been "trying to make positive change in the Third World in emerging markets."
"We all miss him so much. And it's so sad that such a bright young person is taken away by terrorism," Sarah Spindler added.
Spindler joined the Peace Corps after the Sept. 11 terror attacks and was a graduate of NYU Law and the University of Texas at Austin, and he was the recipient of grants from the Bill and Melinda Gates Foundation and the Clinton Foundation, his mother said.
The U.K.'s Foreign Office confirmed Wednesday that a British-South African national was also among the dead.
A 2013 attack carried out by Al-Shabab at the nearby Westgate Mall in Nairobi that killed 67 people.
Like the attack at the Westgate Mall, this one appeared aimed at wealthy Kenyans and foreigners.
Al-Shabab has vowed retribution against Kenya for sending troops to Somalia to fight it since 2011.
The group has killed hundreds of people in Kenya. In the deadliest attack, al-Shabab claimed responsibility for an assault on Kenya's Garissa University in 2015 that killed 147 people, mostly students.
Brooke Glatz, Caroline Radnofsky, Linda Givetash and Reuters contributed.